CVE-2021-3199

Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

30% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-25)

CISA KEV

listed 2026-10-08, due 2026-10-11

CWE

CWE-22

Published

2021-01-26

Modified

2026-10-09

Record from

the NVD, synced 2026-10-19

Affected

• onlyoffice:document_server

References

• https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563
• https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.py
• https://github.com/nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.py
• https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563
• https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.py

Check your stackJSON