Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.
CVSS
9.8
EPSS
0%
KEV
Yes
Exploitation
reported
CVE Published
2104d ago · NVD
Added to TCL Advisory
22d ago · TCL Advisory
Added to CISA KEV
22d ago · CISA
Exploitation Status Changed
22d ago · TCL Advisory
NVD · Updated 22d ago
CISA KEV · Updated 24d ago