CVE-2021-3199

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2021-3199 9.8

ONLYOFFICE · Docs · Added 2026-10-08 · Published 2021-01-26

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityONLYOFFICE Docs Server Path Traversal Vulnerability

VendorONLYOFFICE

ProductDocs

Date added2026-10-08

Due date2026-10-11

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-22

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.

NVD: Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-10-08 20:03 UTC

Wall time0.7s

Searches10

Component defaultno

Sources https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563
https://github.com/ONLYOFFICE/server/commit/a1e83e1d4e60592ab330a2b6b5903a2469c5b463
https://github.com/ONLYOFFICE/server/blob/v5.6.3.1/DocService/sources/fileuploaderservice.js#L195
https://github.com/ONLYOFFICE/server/blob/a1e83e1d4e60592ab330a2b6b5903a2469c5b463/Common/config/default.json
https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199
https://github.com/moehw/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.py
https://github.com/nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.py
https://github.com/advisories/GHSA-vm8r-r39c-96c6
https://www.checkpoint.com/defense/advisories/public/2021/cpai-2021-0070.html
https://www.ic3.gov/CSA/2026/261008.pdf
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3199
https://nvd.nist.gov/vuln/detail/CVE-2021-3199

Hunting hypothesis agent

Hunt Document Server access logs for JWT-signed POST /upload/<docid>/<uid>/<idx> bodies starting with ENCRYPTED;/../ traversal, chained with POST /docbuilder; nginx logs no bodies by default, so WAF or custom log-format capture is required.

Research details

ComponentuploadImageFile() handler in DocService/sources/fileuploaderservice.js — the /upload/{docid}/{userid}/{index} image-upload endpoint whose ENCRYPTED; body-prefix branch writes an attacker-controlled relative path (JWT-gated)

PreconditionsTarget runs ONLYOFFICE Document Server 5.1.5–5.6.2 (server component through 5.6.3.1, fixed in 5.6.3 / 5.6.3.2); JWT token validation must be enabled in config (services.CoAuthoring.token.enable.browser, default false); attacker needs unauthenticated network reachability to /upload and /docbuilder plus the HS256 session secret to sign valid JWTs (public PoC signs with 'secret'); no user login required agent

Deliveryunauthenticated HTTP POST to an internet-facing Document Server /upload endpoint with an attacker-signed JWT (session secret required)

Public PoCyes

PoC URLs https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199
https://github.com/moehw/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.py
https://github.com/nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.py Third-party repos; verify before use.

Advisoryhttps://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563

Exploit notesCVSS attack complexity LOW (9.8 CRITICAL). Weaponized public PoC from the reporter (moehw/poc_exploits): signs an HS256 session JWT (hardcoded secret 'secret'), POSTs to /upload/<docid>/<uid>/<idx> a body of ENCRYPTED;<relative traversal>;<payload> that overwrites an arbitrary file under App_Data/cache/files (default target .../FileConverter/bin/docbuilder), then POSTs {'token': <JWT>} to /docbuilder with an attacker-controlled URL to execute the planted file (reverse shell). Requires JWT validation enabled and knowledge of the session secret; overwriting a service executable also yields DoS. Check Point ships IPS protection CPAI-2021-0070 (attack name 'Web Server Enforcement Violation'). Joint FBI/CISA/NSA/NCSC-UK CSA AA26-281A lists it as a successfully exploited CVE (impact: unauthorized write).

SummaryCVE-2021-3199 is a CWE-22 path traversal in the ONLYOFFICE Document Server image-upload handler (uploadImageFile in DocService/sources/fileuploaderservice.js) that lets an attacker who can sign session JWTs overwrite arbitrary files via an ENCRYPTED;-prefixed traversal in the upload body, achieving RCE or denial of service by replacing service executables. Affected versions are 5.1.5 through 5.6.2 (server component through 5.6.3.1), fixed in 5.6.3 / 5.6.3.2. A functional public PoC with a reverse-shell payload exists, and the CVE was added to the CISA KEV catalog on 2026-10-08 and listed among successfully exploited CVEs in joint FBI/CISA/NSA/NCSC-UK advisory AA26-281A.

Tia coverage

First reported2026-10-08

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-adds-five-exploited-vulnerabilities-to-kev-catalog

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.