Image-upload path traversal in ONLYOFFICE Docs allows unauthenticated remote code execution (CVE-2021-3199)
CISA added this 2021 flaw to KEV on 2026-10-08 in connection with advisory AA26-281A on Chinese government-linked actors, with a 2026-10-11 remediation deadline; teams running an old Document Server exposed to the internet should assume it is being scanned for and patch or isolate it now.
A /.. sequence in an image upload parameter lets an unauthenticated attacker write files outside the intended directory on an ONLYOFFICE Document Server, which can be leveraged for remote code execution. Public proof-of-concept scripts targeting the image upload endpoint exist on GitHub.
Affected: ONLYOFFICE Docs / Document Server releases prior to the fix recorded in the 5.6.3 changelog entry
How to Test
Record the Document Server version on each host and compare it against the 5.6.3 changelog entry referenced for this fix; anything older is affected. Review web server and Document Server logs for image upload requests whose parameters contain /.. traversal sequences, and check for unexpected files written outside the upload directory; treat such artifacts on an unpatched server as a possible compromise.
How to Patch
Upgrade ONLYOFFICE Docs / Document Server to a release at or beyond the 5.6.3 changelog fix (preferably the current supported version). Until upgraded, restrict network access to the Document Server so that only trusted integrations can reach its upload endpoints.