Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /..…

cisa required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

1. 2021-01-22 Published
2. 2026-10-08 CISA SSVC: exploitation active
3. 2026-10-08 Added to CISA KEV
4. 2026-10-11 CISA patch deadline

Added

32 d ago (2026-10-08)

Patch by

2026-10-11 (29 d ago)

Ransomware

Not known

Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Vendor, product

ONLYOFFICE, Docs

CISA name

ONLYOFFICE Docs Server Path Traversal Vulnerability

Exploitation

Active, exploited in the wild

Automatable

yes

Technical impact

total

Assessed

32 d ago (2026-10-08)

30.24% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

• github.com https://github.com/nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.py referenced PoC, tagged "exploit" by a source, unverified
• github.com https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.py referenced PoC, tagged "exploit" by a source, unverified

Weakness

• CWE-22 Improper Limitation of a Pathname to a Restricted Directory

• github.com /nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.py

  exploit, third-party-advisory

• github.com /moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.py

  exploit, third-party-advisory

• github.com /ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563

  release-notes, third-party-advisory

• cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3199

  government-resource, us-government-resource

• CVE List CVE-2021-3199
• NVD CVE-2021-3199

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.