ONLYOFFICE DocumentServer EUVD-2026-101034

Exploitation requires the DocumentServer to expose the /downloadfile/:docid endpoint and to have JWT verification disabled - which, per the description, is the DEFAULT configuration, so no operator misconfiguration is needed. The attacker must be able to submit a request body setting the isInJwtToken flag so the server treats the fetch as a DIRECT request, skipping the private-address request-filtering-agent. Limiting factors: instances where JWT verification/signing has been explicitly ENABLED (a common hardening step in production integrations such as Nextcloud) are not exploitable via this path, and impact is bounded to data the server can reach and proxy back (internal services and cloud metadata); there is no direct code execution or integrity/availability impact. The highest-value targets are cloud-hosted instances where the metadata service exposes IAM credentials.

This is a genuine but moderate-priority issue rather than a critical emergency. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated exploitation, but the impact is constrained to subsequent-system confidentiality only (SC:L, with VC:N/VI:N/VA:N and SI:N/SA:N), which matches the SSRF nature (CWE-918): the attacker reads/proxies back data, not full compromise of the DocumentServer itself. Notably, the vendor vector includes AT:P (an attack requirement), yet the description states the flawed code path is reachable in the DEFAULT configuration when JWT verification is disabled - this is a mild internal conflict: the 'requirement' (JWT verification off) is actually the shipped default, so real-world reachability is higher than AT:P alone implies. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so this is 'no public exploit identified at time of analysis'; the finding was reported by VulnCheck (a credible research source) and a vendor patch (v10.0.0) exists. The headline risk is SSRF against cloud metadata endpoints (e.g., 169.254.169.254), which can escalate to credential theft in cloud deployments even though the raw CVSS impact is rated low - defenders in AWS/GCP/Azure environments should treat the effective severity as higher than 6.3 suggests. Absence of EPSS/KEV/POC signals means widespread automated exploitation is not yet demonstrated.

A remote, unauthenticated attacker sends a crafted POST to the /downloadfile/:docid endpoint of an internet-exposed ONLYOFFICE DocumentServer running the default (JWT-verification-disabled) configuration, placing an internal or loopback URL (such as the cloud metadata service) in the request body. Because the isInJwtToken flag causes the request to be treated as DIRECT, the private-address request-filtering-agent is skipped, and the server fetches the URL and proxies the response back to the attacker. This enables reconnaissance of the internal network and theft of cloud instance metadata/credentials. No public exploit code is identified at time of analysis, but the technique is straightforward given the described default-config reachability.