CVE-2026-110652
MediumCVSS 4.0Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint. Attackers can bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in the default configuration, causing the server to fetch and proxy back arbitrary private-network and cloud metadata content.
Risk Assessment
An unauthenticated remote attacker could access internal network resources and cloud metadata through the ONLYOFFICE DocumentServer. This may lead to disclosure of sensitive information and use of the server as a proxy for attacks on internal infrastructure.
Recommendation
Update ONLYOFFICE DocumentServer to version 10.0.0 or later. Ensure JWT verification is enabled and configure appropriate outbound network request filtering.
Other vulnerabilities in ONLYOFFICE DocumentServer
See all- CVE-2023-30187Critical
An out-of-bounds memory access vulnerability in ONLYOFFICE DocumentServer versions 4.0.3 through 7.3.2. A remote attacker can execute arbitrary code using a crafted JavaScript file.
- CVE-2023-30186Critical
A use-after-free vulnerability in ONLYOFFICE DocumentServer versions 4.0.3 through 7.3.2 allows remote attackers to execute arbitrary code via a crafted JavaScript file.
- CVE-2026-41034Medium
ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via pictFmla.cbBufInCtlStm and other vectors), leading to an information leak and ASLR bypass.
Original NVD description (English source)
ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in the default configuration. Attackers can submit a crafted request body containing an internal or loopback URL, which is treated as a DIRECT request skipping private-address filtering, causing the server to fetch and proxy back arbitrary private-network and cloud metadata content.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS