plaincve:~$

// threat brief

CVE-2021-3199Actively exploited

ONLYOFFICE Document Server image upload path traversal: can lead to remote code execution, exploited in the wild

CVSS
9.8 CRITICAL
CISA KEV
2026-10-08
Weakness
CWE-22
Topics
Web apps · Infrastructure

PlainCVE Team · Published 2026-10-13 · AI-assisted · Press brief ↓

AI review 2026-10-13 (not human-reviewed)Command tests: none yetReproduced: not yetVerification record ↓

ONLYOFFICE Document Server before 5.6.3 has a path traversal in image uploads that can lead to remote code execution; exploited in the wild.

Who is affectedOrganizations running ONLYOFFICE Document Server (ONLYOFFICE Docs) before 5.6.3 with JWT enabled, where the /upload endpoint is reachable over the network.
What happensAn attacker may be able to exploit directory traversal in image uploads to run code on the server. CISA's assessment rates the technical impact as "total".
What to do nowUpgrade ONLYOFFICE Document Server to 5.6.3 or later (the vendor's CHANGELOG lists the fix in 5.6.3; HKCERT gives the same advice). The sources describe no workaround other than upgrading.
Affected versionsVersions before 5.6.3, not including 5.6.3 (the CVE record says before 5.6.3; NVD range is versionEndExcluding 5.6.3; OSV's auto-derived list runs from 5.6.2 back to 3.0.0 and Online-Editors-2.5)
Fixed versions5.6.3 or later (per the vendor's 5.6.3 CHANGELOG; HKCERT gives the same advice)
CVSS vector
Show full vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Timeline
  • First public 2020-08-17
CISA KEVListed (2026-10-08): attacks have been seen in the wild

Blue team playbook

Check, fix / mitigate, respond, harden. Matching the affected versions does not mean you were compromised, and a check that finds nothing does not prove you are safe; each item says what it can and cannot show. Tagged steps point to where the attack flow below can be stopped.

DETECTCheckAm I affected? Any signs of compromise?
  1. 01Check your version and exposure

    You are in the affected range if all three hold: Document Server before 5.6.3, JWT enabled, and the /upload endpoint reachable over the network.

    Step 1
  2. 02No official detection guidance

    No source gives detection guidance or indicators of compromise; the seven-country joint advisory PDF could not be read. PlainCVE suggests: if you ran an old version that was exposed, look for unknown files outside the upload folder and unusual processes on the server.

    Step 3Step 4
MITIGATEFix / mitigatePatch; block it if you cannot patch yet
  1. 01Upgrade to 5.6.3 or later

    HKCERT recommends upgrading to 5.6.3 or later. Later releases are expected to include the fix (PlainCVE's inference).

    Step 3Step 4
  2. 02Can't upgrade: stop using it per CISA; or limit exposure (PlainCVE's suggestion, not a source-provided mitigation)

    The sources describe no workaround besides upgrading. CISA tells federal agencies to follow vendor instructions, or stop using the product if no mitigation is available.

    Step 1
RESPONDRespondIf you find signs of compromise
  1. 01Treat exposed old servers as possibly compromised

    PlainCVE's suggestion: the flaw can lead to remote code execution and is being exploited. If an old version was exposed, investigate, rebuild from a clean environment, and replace the server's JWT secret and other credentials.

    Step 4
HARDENHardenPrevent the next one
  1. 01Use a strong, non-default JWT secret

    Vendor documentation says ONLYOFFICE Docs verifies requests with JWTs signed by the server key. PlainCVE's general suggestion (no source confirms how it relates to this flaw) is to avoid default or guessable secrets.

    Step 2
  2. 02Don't expose document servers directly to the internet

    PlainCVE's suggestion: allow only the applications that need it to reach the document server.

    Step 1
Full remediation steps and notes
  1. Upgrade. The 5.6.3 section of the vendor’s CHANGELOG lists “Fix Path Traversal vulnerability via image upload params (Bug #46113)”, so the vendor itself confirms 5.6.3 fixes this issue; HKCERT also recommends 5.6.3 or later. Later releases are expected to include the fix (PlainCVE’s inference); upgrading to a current release is our suggestion.
  2. Fix mapping. OSV maps the fix to commit 0187bea803abdd2b2b6ad8168272d77e27739add, but that was derived automatically from a CPE range and no vendor source confirms it. The third-party Cloudron package notes for 5.6.3 mention the same fix (Bug #46113), consistent with the vendor’s CHANGELOG.
  3. No workaround. The sources describe nothing besides upgrading. CISA tells federal agencies to follow vendor instructions or stop using the product if no mitigation exists.
  4. Investigate before and after. For an exploited flaw, upgrading does not remove anything an attacker already planted. If an old version was exposed, follow the “respond” steps in the playbook.

Attack flow

Read left to right: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Click an icon for details.

Read top to bottom: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Tap an icon for details.

ONLYOFFICE Document Server image upload path traversal: can lead to remote code execution, exploited in the wild: 1. Finds a reachable /upload endpoint on an ONLYOFFICE server → 2. Sends an image upload whose parameter contains a "go up one folder" path segment → 3. The server does not properly limit the path (directory traversal, CWE-22) → 4. Runs code on the serverCVE-2021-3199 · ONLYOFFICE Document Server image upload path traversal: can lead toremote code execution, exploited in the wildAttackerYour systemFinds a reachable /upload endpoint on an ONLYOFFICE server — The server must run a version before 5.6.3 and have JWT (a signed token used to prove a request is legitimate) enabled. 1Finds a reachable/upload endpointon an ONLYOFFICEserverSends an image upload whose parameter contains a "go up one folder" path segment — The CVE description says the problem is a /.. sequence in an image upload parameter. No source says whether the attacker needs to know the server's JWT signing secret. 2Sends an imageupload whoseparameter containsa "go up on…The server does not properly limit the path (directory traversal, CWE-22) — This is CWE-22 path traversal: the code doesn't keep the file name inside the allowed folder. 3The server doesnot properly limitthe path(director…Runs code on the server — The CVE description says this can lead to remote code execution; HKCERT also lists security restriction bypass. 4Runs code on theserverAttack pathCan be stopped herePlainCVE · plaincve.date/en/vulns/cve-2021-3199-onlyoffice-docs-upload-path-traversal · CC BY 4.0
ONLYOFFICE Document Server image upload path traversal: can lead to remote code execution, exploited in the wild: 1. Finds a reachable /upload endpoint on an ONLYOFFICE server → 2. Sends an image upload whose parameter contains a "go up one folder" path segment → 3. The server does not properly limit the path (directory traversal, CWE-22) → 4. Runs code on the serverCVE-2021-3199 · ONLYOFFICE DocumentServer image upload path traversal: canlead to remote code execution, exploitedin the wildFinds a reachable /upload endpoint on an ONLYOFFICE server — The server must run a version before 5.6.3 and have JWT (a signed token used to prove a request is legitimate) enabled. 1AttackerFinds a reachable /uploadendpoint on an ONLYOFFICE serverSends an image upload whose parameter contains a "go up one folder" path segment — The CVE description says the problem is a /.. sequence in an image upload parameter. No source says whether the attacker needs to know the server's JWT signing secret. 2AttackerSends an image upload whoseparameter contains a "go up onefolder" path segmentThe server does not properly limit the path (directory traversal, CWE-22) — This is CWE-22 path traversal: the code doesn't keep the file name inside the allowed folder. 3Your systemThe server does not properlylimit the path (directorytraversal, CWE-22)Runs code on the server — The CVE description says this can lead to remote code execution; HKCERT also lists security restriction bypass. 4AttackerRuns code on the serverAttack pathCan be stopped herePlainCVE · CC BY 4.0plaincve.date/en/vulns/cve-2021-3199-onlyoffice-docs-upload-path-traversal
Free to use in reporting and teaching under CC BY 4.0. Attribution is already on the image.
  1. Attacker

    Finds a reachable /upload endpoint on an ONLYOFFICE server

    The server must run a version before 5.6.3 and have JWT (a signed token used to prove a request is legitimate) enabled.

    Defense: Don't expose the document server's upload endpoint to untrusted networks (PlainCVE's suggestion).

  2. Attacker

    Sends an image upload whose parameter contains a "go up one folder" path segment

    The CVE description says the problem is a /.. sequence in an image upload parameter. No source says whether the attacker needs to know the server's JWT signing secret.

    Defense: Use a strong, non-default JWT secret (PlainCVE's analysis, not confirmed by sources).

  3. Your system

    The server does not properly limit the path (directory traversal, CWE-22)

    This is CWE-22 path traversal: the code doesn't keep the file name inside the allowed folder.

    Defense: Upgrade to 5.6.3 or later.

  4. Attacker

    Runs code on the server

    The CVE description says this can lead to remote code execution; HKCERT also lists security restriction bypass.

    Defense: Upgrade to 5.6.3 or later; run the service under a least-privilege account.

Who is affected

ConditionAffected?
ONLYOFFICE Document Server before 5.6.3 + JWT enabled + /upload reachable over the networkAffected
ONLYOFFICE Document Server 5.6.3 or laterFixed (per the vendor’s 5.6.3 CHANGELOG, HKCERT and the NVD version range)
Before 5.6.3 but not using JWTThe CVE description only says it happens “when JWT is used”; the sources say nothing about other setups

CISA’s KEV catalog lists the product as ONLYOFFICE “Docs”, i.e. Document Server. OSV’s affected list, derived automatically from the CPE range, runs from 5.6.2 back to 3.0.0 and Online-Editors-2.5. No source says which version introduced the flaw (OSV only uses the placeholder “0”).

How it works

ONLYOFFICE Document Server is a self-hosted online document editing server. The flaw is in the server’s /upload endpoint, which handles image upload parameters. Vendor documentation says ONLYOFFICE Docs uses JWT (a signed token that proves a request is legitimate) to prevent unauthorized access and parameter tampering.

According to the CVE description, when JWT is used, directory traversal can occur via a /.. (“go up one folder”) sequence in an image upload parameter, which can lead to remote code execution. This class of bug is called path traversal (CWE-22). HKCERT also lists security restriction bypass as an impact. PlainCVE’s interpretation (not confirmed by sources) is that the server may end up writing files outside the intended folder.

The flawed approach (conceptual illustration, not the original source code):

Show code example(python)
# Glue the name from the request straight onto the upload folder
path = UPLOAD_DIR + "/" + name_from_request
save(path, data)

The fixed approach:

Show code example(python)
# Normalize the path, confirm it is still inside the upload folder, otherwise reject
path = normalize(join(UPLOAD_DIR, name_from_request))
if not path.startswith(UPLOAD_DIR + "/"):
    reject()
save(path, data)

About the JWT secret (our analysis): No source says whether an attacker needs to know or guess the server’s JWT signing secret. PlainCVE’s general suggestion is to avoid default or guessable secrets, but no source confirms how this affects the risk from this flaw. Also, the CVSS 3.1 rating says no privileges are required, which sits awkwardly with the “when JWT is used” condition; no source explains the authentication model.

Timeline

DateEvent
2020-08-17The vendor’s commit adff7d7 (“Add 5.6.3 changelog”) publicly lists the 5.6.3 fix for path traversal via image upload params (Bug #46113) in the CHANGELOG; 5.6.3 is released the same day (first disclosure)
2021-01-21CVE ID reserved
2021-01-22MITRE publishes the CVE record
2021-01-26NVD publishes its entry
2026-10-08CISA adds it to the Known Exploited Vulnerabilities catalog
2026-10-11CISA’s remediation deadline for federal agencies

No source says when exploitation began or whether the flaw was exploited before a fix existed.

Further reading

  • Scoring: NVD and CISA-ADP both give CVSS 3.1 9.8 (Critical); NVD’s older CVSS 2 score is 7.5 (High). The difference comes from the scoring version. CISA’s SSVC assessment rates technical impact as “total”, the flaw as automatable, and exploitation as “active”.
  • EPSS: GitHub’s data shows an EPSS score (an estimate of the chance of exploitation) of about 0.19, in the 97.3rd percentile.
  • Public exploit code: NVD tags some references as Exploit, meaning proof-of-concept code is public.
  • Attribution (news reports): The Hacker News says CISA added the flaw after its abuse by the China-linked actor Flax Typhoon; Security Affairs, citing a seven-country joint advisory, links it to China-linked actors associated with Integrity Technology Group. The joint advisory PDF could not be read, so this page has not verified it further.
  • Ransomware: CISA lists ransomware use as “Unknown”.
  • Directive mismatch: The KEV record cites BOD 26-04, while Security Affairs cites BOD 22-01; this page treats the KEV record as the primary source.

Verification Checked item by item against sources by AI under our review rules, all passed; not human-reviewed and not yet reproduced in our lab

AI review2026-10-13 · review rules

Verification records describe the environment and the result only, never reproduction steps or code that could attack other people’s systems. See our policy.

Sources

  1. CVE / NVD / OSVCVE-2021-3199 Record (CVE Services API) · MITRE / CVE Program, 2021-01-22 · accessed 2026-10-13
  2. CVE / NVD / OSVNVD - CVE-2021-3199 · NIST, 2021-01-26 · accessed 2026-10-13
  3. AdvisoryCISA KEV catalog entry for CVE-2021-3199 (snapshot) · CISA, 2026-10-08 · accessed 2026-10-13
  4. AdvisoryONLYOFFICE Docs Remote Code Execution Vulnerability · HKCERT · accessed 2026-10-13
  5. OtherOSV - CVE-2021-3199 · OSV · accessed 2026-10-13
  6. Patch / releaseONLYOFFICE DocumentServer CHANGELOG.md · ONLYOFFICE (GitHub), 2020-08-17 · accessed 2026-10-13
  7. Patch / releaseONLYOFFICE-DocumentServer-5.6.3 release (GitHub API) · ONLYOFFICE (GitHub), 2020-08-17 · accessed 2026-10-13
  8. OtherOnlyOffice package updates · Cloudron Forum · accessed 2026-10-13
  9. VendorONLYOFFICE Docs API FAQ: Security · ONLYOFFICE · accessed 2026-10-13
  10. OtherGitHub Advisory Database entry for CVE-2021-3199 · GitHub · accessed 2026-10-13
  11. NewsFlax Typhoon exploits five flaws · The Hacker News · accessed 2026-10-13
  12. NewsU.S. CISA adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND flaws to its Known Exploited Vulnerabilities catalog · Security Affairs · accessed 2026-10-13

Press brief

In one sentence

ONLYOFFICE Docs is a self-hosted online document editing server. Versions before 5.6.3, when JWT is used, have a path traversal flaw in the /upload image upload function that may let attackers who can reach that endpoint over the network run code on the server. The vendor publicly listed the path traversal fix in its CHANGELOG when it released 5.6.3 on August 17, 2020, and the CVE record followed in January 2021, yet the US agency CISA added it to its Known Exploited Vulnerabilities catalog only on October 8, 2026; news reports link the attacks to China-linked threat actors.

Key facts

Severity
CVSS 3.1 9.8 (NVD) services.nvd.nist.gov
Added to CISA KEV
2026-10-08 (federal deadline 2026-10-11) cisa.gov
Fixed version
5.6.3 or later github.com
First disclosed (vendor CHANGELOG / 5.6.3 release)
2020-08-17 api.github.com
CVE published
2021-01-22 cveawg.mitre.org
Attribution (news report)
The Hacker News: Flax Typhoon thehackernews.com

Confirmed

  • Before 5.6.3, with JWT in use, an image upload parameter on /upload allows path traversal that can lead to remote code execution.
  • CISA lists it in the Known Exploited Vulnerabilities catalog, and HKCERT says it is being exploited in the wild.
  • Upgrading to 5.6.3 or later fixes it (per the vendor's 5.6.3 CHANGELOG, HKCERT and the NVD version range).

Unconfirmed / disputed

  • No source says whether an attacker needs the server's JWT secret.
  • No source says when exploitation began or whether it was exploited before a fix existed (zero-day).
  • The KEV record cites BOD 26-04 while Security Affairs cites BOD 22-01.
  • Attribution comes from news reports: The Hacker News names Flax Typhoon; Security Affairs names China-linked actors associated with Integrity Technology Group.

Quotable line

A bug publicly fixed six years ago is still being exploited today: a patch only counts once it is actually installed.

Images

Download the share image (PNG) · Attack flow diagram (downloadable)

Please credit "PlainCVE" and link to this page. Full citation format is under "How to cite" below. Found a factual error? Report it.

How to cite this page

This article is CC BY 4.0. Please keep the attribution and link when republishing.

PlainCVE Team (2026). "ONLYOFFICE Document Server image upload path traversal: can lead to remote code execution, exploited in the wild". PlainCVE. https://plaincve.date/en/vulns/cve-2021-3199-onlyoffice-docs-upload-path-traversal (accessed YYYY-MM-DD)
BibTeX
@misc{cve20213199onlyofficedocsuploadpathtraversal2026,
  title  = {ONLYOFFICE Document Server image upload path traversal: can lead to remote code execution, exploited in the wild},
  author = {PlainCVE Team},
  year   = {2026},
  howpublished = {PlainCVE},
  url    = {https://plaincve.date/en/vulns/cve-2021-3199-onlyoffice-docs-upload-path-traversal},
  note   = {Updated 2026-10-13}
}