CVE-2020-11534: ONLYOFFICE Document Server

Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days.

An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the NSFileDownloader function to pass parameters to a binary (such as curl or wget) and remotely execute code on a victim's server.

Affected products

• ONLYOFFICE Document Server: version 5.5.0 only

Published 2020-04-15. Last modified 2026-06-17.