ONLYOFFICE Document Server EUVD-2026-100761

Exploitation requires (1) a valid Inbox-compatible JWT accepted by the server, i.e. the attacker must possess or be issued a token signed with the deployment's JWT secret - in setups where this secret is shared across integrations or tenants this is a low bar, but strict per-tenant secret isolation raises it; and (2) use of the Document Builder API's builder.SaveFile() with its optional third argument to supply user-controlled converter XML containing a duplicate m_sFileTo element. The vulnerability is in default processing of that converter XML (no non-default feature toggle is mentioned), and affects ONLYOFFICE Document Server versions before 10.0.0. Limiting factors: authentication via a valid JWT is mandatory (PR:L), and full command execution is not instantaneous - it requires a subsequent Document Builder job to process the poisoned runtime.json configuration.

This is a genuine, actionable priority rather than a CVSS-inflated non-issue, though it is not an emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity attack requiring only low privileges - specifically a valid Inbox-compatible JWT - with high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H) but no subsequent-system scope change (SC:N/SI:N/SA:N), consistent with command execution confined to the host as the ds service account. The signals are internally consistent: the description's 'authenticated attacker with a valid JWT' matches PR:L, and the network-delivered Document Builder API call matches AV:N. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is: no public exploit identified at time of analysis. The key tempering factors are the authentication requirement (a valid JWT, which in many deployments is a shared secret available to any integrated application or tenant) and the absence of evidence of active exploitation. Net: treat as a high-value patch target - the authentication barrier is modest where JWT secrets are shared, and the outcome is full OS command execution - but there is currently no data indicating mass or targeted exploitation.

An attacker holding a valid Inbox-compatible JWT (e.g., a malicious or compromised integrated application, or an attacker who has obtained the shared JWT secret) submits a Document Builder job via the API, passing crafted converter XML in the optional third argument of builder.SaveFile(). A duplicate m_sFileTo element overrides the server-generated output path, letting them overwrite runtime.json to point the Document Builder executable at an attacker-controlled binary or arguments, so the next job runs arbitrary OS commands as the ds account. No public exploit code was identified at time of analysis.