TI-2026-73864 Aliases CVE-2026-110385 GHSA-4j4f-mq3p-mc2r

Remote code execution in ONLYOFFICE Document Server builder API

MEDIUM 42CWE-73Published 2026-10-14 · Updated 2026-10-14

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

ONLYOFFICE Document Server versions before 10.0 are affected. The Document Builder API does not properly process user-controlled converter XML passed to builder.SaveFile(), so a duplicate m_sFileTo element lets the output path be overridden (CWE-73). An authenticated remote attacker with a valid Inbox-compatible JWT can write files outside the job directory, overwrite runtime.json, and run operating system commands as the ds service account when a later Document Builder job is processed.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled converter XML supplied through the optional third argument of builder.SaveFile(). By injecting a duplicate m_sFileTo element, an attacker can override the server-generated output path and write arbitrary content outside the designated job directory. This allows the attacker to overwrite the runtime.json configuration file, modify the Document Builder executable path and arguments, and execute arbitrary commands when a subsequent Document Builder job is processed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01042 64th percentileScored 2026-11-07

Fix Fixed Document Server (ONLYOFFICE): 10.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ONLYOFFICE	Document Server	before 10.0	10.0	Patch available	CNA

Document Server VendorONLYOFFICE Affected before 10.0 Fixed in 10.0 Patch available CNA

Remediation

Update ONLYOFFICE Document Server to version 10.0, which fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA Document Server (ONLYOFFICE) Fixed in 10.0

Timeline

2026-10-14 Threatist record created from CVE-2026-110385
2026-10-14 Alias added: GHSA-4j4f-mq3p-mc2r
2026-10-15 CISA SSVC decision points changed

References

Other 1

https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md

TI-2021-02273 Path traversal in ONLYOFFICE Document Server enables code execution KEVCVSS 3.1CRITICAL 9.8
TI-2023-17445 Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code… CVSS 3.1CRITICAL 9.8
TI-2023-14162 An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through… CVSS 3.1CRITICAL 9.8
TI-2023-14161 A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows… CVSS 3.1CRITICAL 9.8
TI-2023-14163 Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows… CVSS 3.1HIGH 7.5
TI-2021-19374 ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. CVSS 3.1HIGH 7.5

See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences