Read the docs
TI-2026-73986 Aliases CVE-2026-110652GHSA-hfqc-w8rp-668p

Server-side request forgery in ONLYOFFICE DocumentServer downloadfile endpoint

Priority LOW 28CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

ONLYOFFICE DocumentServer from 2.5.0 before 10.0.0 contains a server-side request forgery flaw (CWE-918) in the /downloadfile/:docid endpoint. An unauthenticated remote attacker can submit a crafted request body with an internal or loopback URL, which the server treats as a direct request that skips private-address filtering when JWT verification is disabled, as it is by default. The server then fetches and proxies back private-network and cloud metadata content.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

Description from the CNA

ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in the default configuration. Attackers can submit a crafted request body containing an internal or loopback URL, which is treated as a DIRECT request skipping private-address filtering, causing the server to fetch and proxy back arbitrary private-network and cloud metadata content.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00398 34th percentileScored 2026-11-07
Fix Fixed DocumentServer (ONLYOFFICE): 10.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ONLYOFFICEDocumentServer2.5.0 to before 10.0.010.0.0Patch availableCNA
  • DocumentServer VendorONLYOFFICE Affected 2.5.0 to before 10.0.0 Fixed in 10.0.0 Patch available CNA

Remediation

Update ONLYOFFICE DocumentServer to version 10.0.0 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

  • Fix · CNA DocumentServer (ONLYOFFICE) Fixed in 10.0.0

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-110652
  2. 2026-10-14 CISA SSVC decision points changed
  3. 2026-10-14 Priority changed: MEDIUM → LOW
  4. 2026-10-14 Alias added: GHSA-hfqc-w8rp-668p

References

Patch 1

Other 1

  • TI-2021-02273 Path traversal in ONLYOFFICE Document Server enables code execution KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-17445 Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code… CVSS 3.1CRITICAL 9.8
  • TI-2023-14162 An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through… CVSS 3.1CRITICAL 9.8
  • TI-2023-14161 A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows… CVSS 3.1CRITICAL 9.8
  • TI-2023-14163 Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows… CVSS 3.1HIGH 7.5
  • TI-2021-19374 ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. CVSS 3.1HIGH 7.5
See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences