CVE-2021-43449: ONLYOFFICE Server

High severity, CVSS 8.1. EPSS: 1.2% chance of exploitation in the next 30 days.

ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). The document editor service can be abused to read and serve arbitrary URLs as a document.

Affected products

• ONLYOFFICE Server: up to and including 7.0.0.49

Published 2023-01-23. Last modified 2026-06-17.