CVE-2021-3199 — Vulnerability intelligence

ONLYOFFICE — Docs

Published: 2021-01-22T02:41:34.000Z

CVSS

9.8

CISA KEV

Known exploitation

Original source text (not a translation)

ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.

Sources

• ONLYOFFICE Docs Server Path Traversal Vulnerability
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• CVE-2021-3199