CVE-2021-3199: ONLYOFFICE Docs Server Path Traversal Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2026-10-08. EPSS: 19.4% chance of exploitation in the next 30 days.

Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.

Affected products

• ONLYOFFICE Document Server: before 5.6.3 (fixed in 5.6.3)

Published 2021-01-26. Last modified 2026-10-09.