TL;DR: Upgrade ONLYOFFICE Docs to version 5.6.3 or later immediately. If patching is not immediately possible, follow CISA's BOD 26-04 guidance and assess whether the instance can be isolated or taken offline until it is remediated.
What Is the Vulnerability?
CVE-2021-3199 is a path traversal (CWE-22) vulnerability in the /upload endpoint of ONLYOFFICE Document Server. An attacker can inject a /.. sequence into an image upload parameter to escape the intended upload directory and write files to arbitrary locations on the server.
What makes this flaw particularly severe is that it is exploitable even when JSON Web Token (JWT) authentication is configured — a control that many administrators rely on to restrict access to the Document Server API. The vulnerability carries a CVSS 3.1 score of 9.8 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning it is network-reachable, requires no privileges, and demands no user interaction.
According to NVD, successful exploitation can lead to remote code execution (RCE), giving an attacker full control over the host running the document server.
Who and What Is Affected?
The affected product is ONLYOFFICE Docs (Document Server) in all versions before 5.6.3. Organizations running any self-hosted instance of ONLYOFFICE Docs below that version should consider themselves exposed.
- Self-hosted deployments — Any organization that has deployed ONLYOFFICE Docs on-premises or in a private cloud environment using a vulnerable version.
- JWT-protected instances — Critically, enabling JWT does not protect against this vulnerability. Administrators who assumed JWT provided a sufficient compensating control should re-evaluate.
- Internet-facing instances — Instances reachable from the public internet represent the highest-risk exposure, as the CVSS vector confirms the attack is fully remote with no authentication requirement.
If you are uncertain which version of ONLYOFFICE Docs your organization is running, check the administration panel or consult your deployment configuration against version 5.6.3 as the minimum safe release.
What Is the Potential Impact?
The CVSS 3.1 score of 9.8 Critical reflects the worst-case triad of Confidentiality, Integrity, and Availability — all rated High:
- Confidentiality: An attacker who achieves RCE can read any file accessible to the document server process, including configuration files, credentials, and stored documents.
- Integrity: Arbitrary file writes and remote code execution allow an attacker to modify server content, plant backdoors, or alter documents processed by the server.
- Availability: An attacker can crash or corrupt the service, or use the compromised host as a pivot point for further attacks within the network.
CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-08, confirming that exploitation of this class of vulnerability is a real-world concern that warrants urgent action. CISA's KEV summary states the flaw "could allow for remote code execution."
What Should You Do Right Now?
The primary remediation is straightforward: upgrade ONLYOFFICE Docs to version 5.6.3 or later. Consult the official ONLYOFFICE vendor documentation and release notes for upgrade instructions specific to your deployment method (Docker, DEB/RPM packages, or the ONLYOFFICE cloud).
If immediate patching is not feasible, CISA's required action under BOD 26-04 applies:
- Apply vendor mitigations in accordance with ONLYOFFICE's official guidance.
- Restrict network access to the Document Server's upload endpoint at the firewall or reverse-proxy level as a temporary compensating control.
- Assess internet exposure — determine whether the instance is reachable from the public internet and isolate it if patching cannot be completed promptly.
- Discontinue use if mitigations are unavailable and exposure cannot be reduced, as directed by BOD 26-04 guidance.
- Conduct forensic triage per CISA's Forensics Triage Requirements if the instance was internet-exposed during the vulnerability window, as CISA's KEV listing indicates active exploitation risk.
Federal agencies are subject to BOD 26-04 patching timelines. All other organizations are strongly encouraged to treat CISA KEV entries as high-priority remediation items regardless of regulatory obligation.
Primary sources: NVD CVE-2021-3199 | CISA KEV Catalog
How Continuous External Testing Surfaces This Exposure
One of the most dangerous aspects of CVE-2021-3199 is how easily an exposed instance can go unnoticed. Organizations may not know that an ONLYOFFICE Docs server is internet-facing, running a vulnerable version, or reachable on a non-standard port — until it is too late.
Continuous external attack surface testing addresses this blind spot in several ways:
- Asset discovery: Regular scanning of your externally routable IP space can identify ONLYOFFICE Document Server instances that internal teams may not have catalogued, including those exposed via misconfigured cloud security groups or overlooked reverse-proxy rules.
- Version fingerprinting: External network and host testing can detect the version of ONLYOFFICE Docs in use, flagging instances below 5.6.3 against known vulnerability databases like NVD.
- Endpoint exposure checks: Testing can confirm whether the
/uploadendpoint and associated API surfaces are reachable from the internet, helping prioritize remediation efforts. - Regression testing after patching: After upgrading, continuous testing verifies that the patched version is correctly deployed and that no rollback or parallel instance reintroduced the exposure.
For vulnerabilities on the CISA KEV list — where exploitation risk is confirmed — the window between exposure and exploitation may be short. Waiting for a quarterly penetration test or an annual audit is not an adequate response cadence for a CVSS 9.8 flaw with a KEV listing.
Sources & further reading: NVD CVE-2021-3199 and the CISA KEV catalog are the authority on affected and fixed versions. Vendor/independent analysis: github.com, github.com, github.com, github.com. This advisory contains no exploit code.
Frequently asked questions
Does enabling JWT authentication on ONLYOFFICE Docs protect against CVE-2021-3199?
No. According to NVD's description, the vulnerability occurs specifically when JWT is in use. JWT authentication does not prevent exploitation of this path traversal flaw. Upgrading to version 5.6.3 or later is the required fix.
Is CVE-2021-3199 being actively exploited in the wild?
CISA added CVE-2021-3199 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-08. CISA's KEV catalog documents vulnerabilities that have evidence of active exploitation or represent confirmed exploitation risk requiring prioritized action under BOD 26-04. Organizations should treat this listing as a strong signal to remediate urgently.
What is the minimum safe version of ONLYOFFICE Docs for this vulnerability?
Based on the NVD advisory, ONLYOFFICE Document Server version 5.6.3 is the first release that addresses CVE-2021-3199. Any deployment running a version below 5.6.3 should be upgraded. Consult ONLYOFFICE's official release documentation to confirm the latest available version for your deployment type.
What should we do if we cannot patch immediately?
CISA's required action under BOD 26-04 advises applying vendor mitigations where available, restricting or isolating the affected service to reduce internet exposure, and discontinuing use if mitigations are unavailable. If the instance was internet-facing during the vulnerability window, conduct forensic triage per CISA's guidance. Check the CISA KEV catalog entry for the latest required action details.