Urgent CVE-2021-3199 Vulnerability in ONLYOFFICE Exploited in the Wild
ID: 9fd6c5ab-8335-528c-bd41-5755aec6e3bc
STIX ID: report--9fd6c5ab-8335-528c-bd41-5755aec6e3bc
Feed Name: ThreatCluster
Threat Score
A high-severity path traversal vulnerability (CVE-2021-3199) affecting ONLYOFFICE Document Server versions before 5.6.3 allows remote code execution via manipulated image upload parameters when using JWT; exploitation in the wild has been confirmed and the issue was added to the CISA KEV catalog on 2026-10-08. Administrators are advised to upgrade to 5.6.3 or later immediately and to restrict and validate upload endpoints until patched.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.