ONLYOFFICE Document Server CVE-2025-68935

Exploitation requires an attacker to inject a script payload specifically into the 'Font' field of the Multilevel list settings window in ONLYOFFICE Document Server versions before 9.2.1, and a victim must subsequently open or render the affected document (UI:R). Limiting factors: the attacker needs the ability to reach and populate that document-editing field (typically some editing/collaboration access to the document), and the payload only fires upon victim interaction. Impact is confined to script execution in the user's browser context (C:L/I:L, no availability impact); default configurations without untrusted collaborative editing significantly reduce exposure.

This is a CWE-79 cross-site scripting flaw in ONLYOFFICE Document Server, rated CVSS 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The network attack vector and low complexity are offset by the required user interaction (UI:R) and the limited, non-availability impact (C:L/I:L/A:N) typical of XSS. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation - this points to a real-but-moderate issue rather than an urgent priority. The scope-change flag (S:C) is meaningful: successful injection executes in the victim's browser session against the document server origin, which can extend impact to other components the user is authenticated to. Note that PR:N (unauthenticated) in the CVSS vector sits in tension with the exploitation path, which requires getting a crafted payload into the Multilevel list 'Font' field - in most deployments this implies some level of document-editing access; verify whether anonymous/guest editing is enabled before treating this as fully unauthenticated.

An attacker with the ability to edit a shared document injects a malicious script into the Font field of the Multilevel list settings window. When another user (e.g., a collaborator or reviewer) opens the document and the setting is rendered, the script executes in their browser session against the ONLYOFFICE origin. No public exploit code was identified in the provided data, and successful exploitation depends on the victim interacting with the affected document (UI:R).