CISA adds ONLYOFFICE Docs path traversal flaw to Known Exploited Vulnerabilities catalog

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution vulnerability in ONLYOFFICE Docs to its Known Exploited Vulnerabilities (KEV) catalog. The entry, published on October 8, 2026, sets a federal compliance deadline of October 11, 2026, for agencies to mitigate the risk or cease using the affected software.

The vulnerability, identified as CVE-2021-3199, affects ONLYOFFICE Document Server versions prior to 5.6.3. According to the National Vulnerability Database (NVD), the flaw carries a CVSS score of 9.8, classifying it as critical. The issue stems from a directory traversal weakness that occurs when the server uses JSON Web Tokens (JWT) for authentication. An attacker can exploit this by inserting a `..` sequence into an image upload parameter within the `/upload` endpoint. This manipulation allows the attacker to traverse directories and execute arbitrary code on the server remotely.

Context and Background

CISA’s inclusion of a vulnerability in the KEV catalog signifies that the agency has observed the flaw being exploited in the wild against US federal systems. While the source material notes that ransomware use remains unknown, the addition to the KEV list triggers specific compliance requirements under Binding Operational Directive (BOD) 26-04. This directive requires federal agencies to prioritize security updates based on risk and adhere to strict patching guidelines.

The NVD record highlights the specific technical mechanics of the exploit. It cites CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) as the underlying weakness. The vulnerability is present in the handling of image uploads when JWT authentication is active. By manipulating the input parameters, an adversary can bypass intended directory restrictions, leading to remote code execution. This type of flaw is particularly dangerous in collaborative document editing platforms, which often have broad network exposure.

Who is affected

The primary entities affected are US federal agencies and any organization using ONLYOFFICE Document Server versions earlier than 5.6.3. The CISA entry explicitly states that stakeholders are responsible for evaluating the internet exposure of each asset running this software. Organizations relying on cloud services hosting this version of ONLYOFFICE Docs must follow applicable BOD 26-04 guidance. If mitigations are unavailable for cloud-hosted instances, the directive requires the discontinuation of the product’s use.

The vulnerability is not limited to federal infrastructure. Any deployment of ONLYOFFICE Docs that utilizes JWT and exposes the upload functionality to untrusted input is potentially vulnerable. The critical severity rating indicates that the ease of exploitation and the impact of successful attacks are high, making immediate attention necessary for all users of the affected software versions.

What should you do?

CISA instructs stakeholders to apply mitigations in accordance with vendor instructions immediately. For federal agencies, compliance with BOD 26-04 is mandatory by the October 11, 2026, federal due date. This involves prioritizing security updates based on risk and ensuring adherence to patching guidelines. If a patch or mitigation is not available, agencies must discontinue use of the product.

Organizations should also follow CISA’s “Forensics Triage Requirements” to assess whether their systems have been compromised. Evaluating the internet exposure of assets running ONLYOFFICE Docs is a critical step in determining risk. Users should verify their current version of ONLYOFFICE Document Server and upgrade to version 5.6.3 or later if possible, as this version reportedly addresses the flaw.