Dromara Skyeye Patched for Critical SSRF and Auth Bypass Vulnerability

The Dromara Skyeye project has addressed a critical security vulnerability that allows unauthenticated attackers to manipulate server requests and overwrite user files. The issue, tracked as CVE-2026-107781, affects versions of the software up to commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321.

According to the National Vulnerability Database (NVD), the flaw carries a CVSS score of 9.1, classifying it as critical. The vulnerability stems from weaknesses categorized under CWE-918. It resides specifically within the OnlyOffice save callback function, identified as `editUploadOfficeFileById`. This endpoint fails to properly authorize requests, enabling attackers to supply arbitrary URL and key parameters.

Technical Details

The vulnerability combines server-side request forgery (SSRF) with a missing authorization control. An unauthenticated attacker can exploit the `editUploadOfficeFileById` endpoint by providing malicious URL and key inputs. This allows the server to fetch internal URLs that are otherwise inaccessible to external users.

Once the server retrieves the internal resource, the attacker can overwrite any user's stored file. The exploitation chain is completed when the attacker uses the `queryFileToShowById` function to read the results of the overwritten file. This sequence effectively grants the attacker the ability to modify data and retrieve the contents of internal systems through the compromised application.

Affected Systems

The vulnerability affects Dromara Skyeye installations. Specifically, any version of the software up to and including commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 is vulnerable. Organizations using this open-source project for collaborative document editing or similar functionalities should verify their current version against this commit hash.

The integration with OnlyOffice is central to the exploit vector. The `editUploadOfficeFileById` callback is part of the mechanism that handles file uploads and edits within the Skyeye platform. Because the endpoint lacks proper authorization checks, it exposes the underlying server to direct manipulation by anyone who can reach the endpoint.

What should you do?

Organizations using Dromara Skyeye should immediately check their deployment version. If the installation is at or below commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321, it is vulnerable. Users should update to a version that includes the fix once the vendor provides the updated release.

Administrators should monitor logs for unusual activity on the `editUploadOfficeFileById` endpoint. Look for requests containing arbitrary URL parameters or unexpected key values. Restricting access to this endpoint via firewall rules or web application firewalls can mitigate risk until a patch is applied.