ONLYOFFICE Docs Server path traversal CVE-2021-3199 used in attacks; fixed in 5.6.3, update old servers
CISA says attackers are exploiting CVE-2021-3199, a 2021 flaw in old ONLYOFFICE Docs servers (before 5.6.3, JWT in use) that can give them remote code execution. If your organisation runs ONLYOFFICE Docs, confirm it is current; ONLYOFFICE recommends 10.0.
If you or your organisation run a self-hosted ONLYOFFICE Docs or Document Server, check its version now and update it (ONLYOFFICE recommends 10.0; 5.6.3 is the minimum fix). Ask your IT provider to check older servers for signs of compromise, since attacks may already have happened.
What’s happening
On 8 October 2026 CISA added CVE-2021-3199 to its list of flaws being used in attacks. It is a path traversal flaw in the upload function of ONLYOFFICE Docs (Document Server), the self-hosted editing server behind many office, file-sharing and Nextcloud-style setups. A crafted "/.." sequence in an image upload parameter, when JWT is in use, can let an attacker write outside the intended folder and run their own code on the server. It carries a CVSS score of 9.8. The flaw is old: it was published in January 2021 and affects versions before 5.6.3, which fixed it. Hong Kong's HKCERT confirmed on 9 October that it is being exploited and told users to upgrade to 5.6.3 or later. ONLYOFFICE said on 14 October that current versions are not affected and recommends updating to ONLYOFFICE 10.0. Aggregator sites note that public proof-of-concept code exists. Some secondary sites attribute the attacks to a China-linked group; we could not confirm that from a primary source, so it is not treated as established. Exact targets and scale of the attacks have not been published in the pages we read.
- What
- Flaw
- Affects
- ONLYOFFICE Docs (Document Server), self-hosted
- Affected
- ONLYOFFICE Document Server (ONLYOFFICE Docs) before 5.6.3, when JWT is used
- Fixed in
- 5.6.3
ONLYOFFICE 10.0 (recommended by the vendor) - Since
- 8 Oct 2026
- Closed
- 14 Oct 2026
Timeline
- UpdateFixed
ONLYOFFICE said in a blog post that the flaw was fixed in version 5.6.3, so current versions are not affected, and urged anyone on older versions to update to ONLYOFFICE 10.0.
- Update
Hong Kong's HKCERT issued a bulletin saying the flaw is being exploited in the wild and advising an upgrade of ONLYOFFICE Document Server to 5.6.3 or later.
- CISA added
CISA added CVE-2021-3199 to its Known Exploited Vulnerabilities catalog, with a federal remediation date of 2026-10-11.
- Made publicFixed
CVE-2021-3199 was published: a directory traversal flaw in the /upload endpoint of ONLYOFFICE Document Server before 5.6.3 that can lead to remote code execution when JWT is used.
Sources
- ONLYOFFICE 10.0: A closer look at the latest 40 security fixesONLYOFFICE · 14 Oct 2026
- ONLYOFFICE Docs Remote Code Execution VulnerabilityHKCERT · 9 Oct 2026
- CVE-2021-3199 (IsItPatched)IsItPatched · 8 Oct 2026
- CVE-2021-3199: Onlyoffice Document Serverstack.watch · 26 Jan 2021