CVE-2020-11536: ONLYOFFICE Document Server

Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days.

An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the unzip function to rewrite a binary and remotely execute code on a victim's server.

Affected products

• ONLYOFFICE Document Server: version 5.5.0 only

Published 2020-04-15. Last modified 2026-06-17.