ONLYOFFICE Docs CVE-2025-68936

Exploitation requires the attacker to inject a malicious script into the Color theme name field of ONLYOFFICE Document Server (before 9.2.1) and have a victim render that theme in the editor, so victim user interaction (opening/viewing the affected document or theme) is a hard prerequisite per UI:R. Exploitation is limited to versions prior to 9.2.1 and, in practice, to an attacker who can create or share a document/theme that the victim will open; impact is confined to the browser/editor context (confidentiality and integrity only, no availability effect). The CVSS claim of PR:N should be treated cautiously because authoring a custom color theme may require an authenticated editing session.

This is a CWE-79 cross-site scripting flaw in ONLYOFFICE Document Server, rated CVSS 6.1 (medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The network vector and low attack complexity favor exploitability, but the required user interaction (UI:R) and the limited, scope-changed browser-context impact (C:L/I:L/A:N) cap severity - this is a classic reflected/stored XSS profile, not a system-compromise bug. No EPSS score, KEV listing, SSVC decision, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk signals that exist (CVSS) and the absent signals (EPSS/KEV/POC) are consistent with a real-but-moderate issue rather than an urgent priority. One point of tension: the CVSS vector asserts PR:N (unauthenticated), yet injecting a malicious 'Color theme name' plausibly requires an authenticated editing session or the ability to share crafted content, so the no-privilege assumption should be verified against the vendor's exploitation model.

An attacker crafts a Color theme whose name contains a malicious script payload and gets it into a document or editor session shared with a victim. When the victim opens the document in ONLYOFFICE Docs and the theme name is rendered without proper sanitization, the script executes in the victim's browser session, enabling session theft or actions in the editor's context. No public POC was provided in the input.