ONLYOFFICE Docs
CVE-2025-68917
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged document/comment access
-
DeliveryInject script payload into comment-edit textarea
-
ExploitVictim opens document and payload renders
-
ExecutionScript executes in victim browser session
-
ImpactHijack session or act as victim in DocumentServer
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account with permission to create or edit comments on a document within ONLYOFFICE Docs/DocumentServer (PR:L) - specifically the ability to submit content into the comment-editing form textarea. Realistic exploitation also depends on a second user subsequently opening the document and rendering the malicious comment, so despite the stated UI:N the attack is effectively gated by victim interaction. It is limited to deployments before version 9.2.1 and to environments where untrusted or lower-trust users share document/comment access with higher-value targets; a purely single-user or fully-trusted-collaborator deployment materially reduces real risk. |
| Impact | This is a moderate-severity stored/reflected XSS (CWE-79) in the comment-editing textarea of ONLYOFFICE Docs/DocumentServer, rated 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so this is NOT a confirmed active-exploitation priority - it reads as a routine web-app XSS fix shipped in release 9.2.1. CONFLICT TO VERIFY: the provided vector states UI:N (no user interaction), but an XSS in a comment-editing form realistically requires a victim to open/render the attacker's comment, which normally implies UI:R - the UI:N and S:C combination appears to overstate the attack by treating it as interaction-free; verify with vendor. The PR:L metric correctly indicates an attacker needs at least a low-privileged account (ability to create/edit a document comment), which limits this to users who can already collaborate on a document rather than anonymous internet attackers. Net: genuine bug worth patching to current release, but low real-world urgency absent any exploitation signal. |
| Exploit ScenarioDerived | An authenticated collaborator with comment access to a shared document injects a malicious script payload into the comment-editing textarea; when another user (potentially a higher-privileged reviewer) opens the document and the comment renders, the script executes in their browser session within the DocumentServer application context. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Stored cross-site scripting in ONLYOFFICE Docs (DocumentServer) before 9.2.1 lets an authenticated user who can create or edit comments inject markup through the comment-editing form's textarea, which then executes in the browser of any other user who opens and renders the affected document. The issue is rated 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); the scope change reflects that the injected script escapes the vulnerable comment component into the surrounding browser and document session, with low confidentiality and integrity impact. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and real-world risk is concentrated in shared or multi-tenant deployments where lower-trust collaborators can reach higher-value accounts; a single-user or fully-trusted-collaborator deployment materially reduces exposure.
RemediationAI
Upgrade ONLYOFFICE Docs/DocumentServer to 9.2.1 or later; the vendor changelog entry for 9.2.1 (https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#921) is the authoritative reference supplied for this fix, and no separate CVE-specific advisory or backport was provided. If immediate upgrade is not possible, the highest-value compensating control is to restrict who can create or edit comments: remove comment/annotation privileges from lower-trust collaborators and constrain document sharing groups so untrusted users cannot place content into documents that higher-value accounts will open, accepting that this degrades collaborative commenting workflows. A restrictive Content-Security-Policy on the DocumentServer front-end can blunt script execution and limit exfiltration, but the editor's legitimate use of inline scripts and dynamic resources frequently forces permissive directives, so CSP should be treated as defense in depth rather than a fix. Deploying ONLYOFFICE behind an authenticating reverse proxy, isolating instances per trust boundary, and shortening editor session/token lifetimes reduce the value of any successfully injected script; none of these eliminate the underlying unsanitized-textarea flaw, so patching to 9.2.1 remains the primary action.
Affected ProductsAI
ONLYOFFICE Docs and its DocumentServer backend are affected in all versions prior to 9.2.1, as stated in the CVE description; the only reference provided is the vendor changelog entry for release 9.2.1 (https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#921), which is where the fix is documented. No CPE entries were supplied with this record, so no formal CPE 2.3 identifier can be cited; the practical affected set is any self-hosted or cloud ONLYOFFICE Docs/DocumentServer instance running a build older than 9.2.1, particularly those where documents and comments are shared between users of differing trust levels. Deployments limited to a single user or a closed, fully-trusted collaborator group are within the affected version range but have a substantially reduced realistic exposure.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-79 improper-neutralization issue (cross-site scripting) in ONLYOFFICE Docs / DocumentServer, the document-editing backend that serves the web-based editor and its collaborative document model. User-supplied content submitted through the textarea of the comment-editing form is not adequately sanitized or output-encoded before being stored and later rendered by the document viewer, so HTML/script fragments survive the round trip and are interpreted as markup in the victim's browser session. Because the payload is persisted with the document/comment and executed when another user renders it, this behaves as a stored XSS rather than a purely reflected one. The CVSS scope change (S:C) is appropriate: the injected script runs outside the security authority of the vulnerable comment component, gaining access to the DOM, session context, and any data or tokens the DocumentServer editor exposes to the page. There are no CPE strings in the supplied data, so affected identification rests on the version boundary stated in the description and the vendor changelog.
Know when Onlyoffice gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Authenticated comment access gives PR:L; XSS realistically needs a victim to view the comment so UI:R; browser-context execution crosses trust boundary (S:C) with limited C/I and no availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Onlyoffice
View allDirectory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT
An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to
A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitr
Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution (RCE) vulnerability via the
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via t
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack overflow via
A file extension handling issue was found in [server] module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21. Rated cri
A heap buffer overflow vulnerability inside of BMP image processing was found at [core] module of ONLYOFFICE DocumentSer
A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. Rated critical
A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13. Rated crit
Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a den
An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.
Exploit-DB