CISA flags exploited ONLYOFFICE Docs flaw that exposes servers to code execution

An image-upload path traversal in ONLYOFFICE Document Server is now on CISA’s exploited-vulnerabilities list. The flaw, CVE-2021-3199, affects servers using JWT and can lead to remote code execution. Teams running ONLYOFFICE Docs should identify the Document Server release on each deployment and move installations older than 5.6.3 to a fixed release.

CISA added the older vulnerability on October 8, 2026, and set October 11 as the catalog’s action date. The October listing raises the urgency for servers left on an old release. Its entry calls for vendor mitigations, an assessment of each asset’s internet exposure and forensic triage under its cited guidance. The version threshold comes from the CVE Program record.

Image uploads reach outside their directory

The CVE record describes directory traversal with remote code execution in the server’s /upload handler before 5.6.3, “when JWT is used.” It names a /.. sequence in an image-upload parameter. An input intended to point at an image can refer outside the directory the server expects; the affected handler can then become a route to server-side code execution. JWT is a condition on this vulnerable path.

NIST’s NVD record also marks ONLYOFFICE Document Server versions before 5.6.3 as vulnerable in its product configuration. That gives administrators a release boundary to compare with deployed builds. For each instance, record whether JWT is enabled and which network clients can reach its upload service. Include servers behind a proxy or embedded in a collaboration portal.

Old releases deserve immediate attention

CISA’s catalog says the flaw is exploited, while its ransomware-campaign field says “Unknown.” Treat a matching older server as a triage priority. If its release or JWT setting is uncertain, resolve that inventory question before marking the server outside the affected condition.

Start with the server’s installed Document Server version and its JWT configuration. Trace the actual network route to the document service, including any reverse proxy that forwards upload requests. Restrict access to the upload service to the clients that need it while upgrading affected installations to 5.6.3 or later. The access rule limits who can reach the path; the version change addresses the affected release range described in the CVE and NVD records.

Confirm updates on each document server

After the change, read back the installed release on every Document Server instance and verify it is 5.6.3 or later. Recheck the service and proxy access rules from an approved client and a network segment that should have no upload access. The expected result is that the approved client retains its document workflow, the unapproved segment cannot reach the upload service, and each server reports a release outside the affected range.

For an older JWT-enabled server, preserve available proxy and application access logs for incident triage and investigate suspicious upload activity through your normal response process. A version and reachability check verifies remediation state; to assess possible past use, review the available server and proxy evidence. CISA’s October 11 catalog date makes the inventory and upgrade work urgent for organizations subject to its guidance. A server that remains reachable on an affected release remains the immediate decision point.