CVE-2020-11535: ONLYOFFICE Document Server

Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days.

An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit XML injection to enter an attacker-controlled parameter into the x2t binary, to rewrite this binary and/or libxcb.so.1, and execute code on a victim's server.

Affected products

• ONLYOFFICE Document Server: version 5.5.0 only

Published 2020-04-15. Last modified 2026-06-17.