EUVD-2026-95259
GHSA-75ff-jv7p-vv6j
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network endpoint (AV:N/PR:N/UI:N) but requires valid file/key context and active callback flow (AC:H); SSRF read and arbitrary file overwrite give C:H/I:H with no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server fetch internal URLs and overwrite any user's stored file, then read results via queryFileToShowById.
AnalysisAI
Unauthenticated server-side request forgery and missing authorization in Dromara Skyeye let remote attackers drive the server to fetch attacker-chosen internal URLs and overwrite any user's stored file through the OnlyOffice save callback editUploadOfficeFileById, then retrieve the modified content via queryFileToShowById. The flaw carries a CVSS 4.0 base score of 9.1 (PR:N, UI:N), although the assessed high attack complexity (AC:H/AT:P) reflects that a valid file id/key and an active OnlyOffice document-editing/callback flow are likely prerequisites, and SSRF reach is bounded by what internal addresses the server can resolve. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a reachable Skyeye instance exposing the OnlyOffice document-save callback endpoint (editUploadOfficeFileById) with the disk-cloud/OnlyOffice document-editing feature in use. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a high-severity, pre-authentication flaw (CVSS 4.0 base 9.1, PR:N) combining server-side request forgery (CWE-918) with a missing-authorization defect in Dromara Skyeye's OnlyOffice save callback (editUploadOfficeFileById). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis, so the priority is compensating controls while tracking https://github.com/dromara/skyeye/issues/29 and the VulnCheck advisory at https://www.vulncheck.com/advisories/dromara-skyeye-unauthenticated-ssrf-and-file-overwrite-via-edituploadofficefilebyid for an official fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, isolate Dromara Skyeye servers from direct internet access and restrict outbound network traffic to only necessary destinations; review OnlyOffice integration logs for unauthorized callback activity (editUploadOfficeFileById, queryFileToShowById) and consider temporarily disabling the OnlyOffice integration if not business-critical. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated OS command injection in Dromara Skyeye allows remote attackers to execute arbitrary commands as the Skye
Unauthenticated attackers can execute arbitrary commands on Dromara Skyeye's bundled xxl-job executor hosts by abusing J
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today