CVE-2021-3199 Exploited in the wild
ONLYOFFICE Docs Server Path Traversal Vulnerability
- Risk score
- 100/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 20.1%
- Published
- 26 Jan 2021
- Added to CISA's exploited list
- 8 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A path traversal vulnerability in ONLYOFFICE Document Server allows remote code execution when a JWT is used. An attacker could exploit this to execute arbitrary code on the server.
- Affected
- {'product': 'ONLYOFFICE Document Server', 'version': 'before 5.6.3'}
- Fix
- Apply mitigations in accordance with vendor instructions
- Exploitation
- Exploited in the wild
Story map
At a glance
Onlyoffice Docs: Red, act today. A path traversal vulnerability in ONLYOFFICE Document Server allows remote code execution when a JWT is used. An attacker could exploit this to execute arbitrary code on the server.
The flaws
- CVE-2021-3199: ONLYOFFICE Docs Server Path Traversal Vulnerability (CVSS 9.8 · EPSS 20% · exploited)
The fix
Upgrade Onlyoffice Docs: 5.6.3 or later on your release line
Who is exposed: {'product': 'ONLYOFFICE Document Server', 'version': 'before 5.6.3'}
Where it stands
- Exploited in the wild
- On CISA's exploited list since 8 Oct
- US federal deadline 11 Oct
How it unfolded
- 8 Oct, CISA (official): Added to the Known Exploited Vulnerabilities list
- 11 Oct, Deadline (official): US federal agencies must have patched
Connects to
- Same weakness: Path traversal (CWE-22). 399 other warnings in 30 days
Why it is Red
- CVSS 9.8 critical
- Exploitation likely: EPSS 20.1% (top 3%)
- Exploited in the wild (CISA KEV)
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
References
- https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563
- https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.py
- https://github.com/nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.py
- https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563
- https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.py
- https://github.com/nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.py
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3199
Original description
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.
Last activity 8 Oct 2026. Patch Forecast updates every hour.