TI-2025-42391 Aliases CVE-2025-68935 GHSA-wxxw-j7jh-6gvh

Cross-site scripting in ONLYOFFICE Document Server

LOW 28CWE-79Published 2025-12-25 · Updated 2025-12-26

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.002 9th percentileScored 2026-11-07

Fix Fixed Document Server (ONLYOFFICE): 9.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ONLYOFFICE	Document Server	before 9.2.1	9.2.1	Patch available	CNA

Document Server VendorONLYOFFICE Affected before 9.2.1 Fixed in 9.2.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:onlyoffice:document_server::::::::	before 9.2.1	Vulnerable	ONLYOFFICE

cpe:2.3:a:onlyoffice:document_server:*:*:*:*:*:*:*:* Versions before 9.2.1 Vulnerable ·ONLYOFFICE

Remediation

Fix · CNA Document Server (ONLYOFFICE) Fixed in 9.2.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2025-12-25
ONLYOFFICE Document Server 9.2.1
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-42392 Cross-site scripting in ONLYOFFICE Document ServerPriority LOW 28
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2025-68935
2026-10-03 Alias added: GHSA-wxxw-j7jh-6gvh

References

Other 1

https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#921

TI-2021-02273 Path traversal in ONLYOFFICE Document Server enables code execution KEVCVSS 3.1CRITICAL 9.8
TI-2023-14162 An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through… CVSS 3.1CRITICAL 9.8
TI-2023-14161 A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows… CVSS 3.1CRITICAL 9.8
TI-2023-14163 Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows… CVSS 3.1HIGH 7.5
TI-2021-07886 A file extension handling issue was found in [server] module of ONLYOFFICE DocumentServer… CVSS 3.1CRITICAL 9.8
TI-2023-25368 Path Traversal vulnerability in ONLYOFFICE Document Server before v8.0.1 allows a remote… CVSS 3.1MEDIUM 6.7

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences