CVE-2023-30187

9.8 criticalEPSS 2.4%

Critical (9.8) in onlyoffice document server. EPSS 2.4% chance of exploitation in the next 30 days.

An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.4% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
CWE: CWE-787
Published: 2023-08-14
Modified: 2026-07-09
Record from: the NVD, synced 2026-10-19

Affected

onlyoffice:document_server

References

https://gist.github.com/merrychap/25eba8c4dd97c9e545edad1b8f0eadc2
https://github.com/ONLYOFFICE/DocumentServer
https://github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctrenderer/
https://github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctrenderer/embed/NativeControlEmbed.cpp#L110
https://github.com/ONLYOFFICE/core/commit/2b6ad83b36afd9845085b536969d366d1d61150a

Check your stack JSON