Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110385

Quick assessment

Affected
ONLYOFFICE Document Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 ONLYOFFICE Document Server 10.0.0 之前的版本中，存在一个远程代码执行漏洞。拥有有效且兼容收件箱（Inbox）的 JWT（JSON Web Token）的认证攻击者，可以以 ds 服务账户的身份执行任意操作系统命令。 Document Builder API 在处理通过 方法的可选第三个参数传入的、由用户控制的转换器 XML 时存在不当处理。攻击者通过注入重复的 元素，可以覆盖服务器生成的输出路径，从而将任意内容写入到指定的任务目录之外。这使得攻击者能够覆盖 配置文件，修改 Do

CVSS 8.7 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110385

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled converter XML supplied through the optional third argument of builder.SaveFile(). By injecting a duplicate m_sFileTo element, an attacker can override the server-generated output path and write arbitrary content outside the designated job directory. This allows the attacker to overwrite the runtime.json configuration file, modify the Document Builder executable path and arguments, and execute arbitrary commands when a subsequent Document Builder job is processed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
文件名或路径的外部可控制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ONLYOFFICE Document Server 0 ~ 10.0 -

II. Public POCs for CVE-2026-110385

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110385

请登录查看更多情报信息。

Other References for CVE-2026-110385 (1)

IV. Related Vulnerabilities

Same product: Document Server
Same vendor: ONLYOFFICE
Same weakness: CWE-73

V. Comments for CVE-2026-110385

No comments yet

Leave a comment