Description
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.
Critical · 9.8
Known exploited CVE-2021-3199
EUVD-2021-26539GHSA-vm8r-r39c-96c6
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /..…
Published Jan 22, 2021 · Updated Oct 9, 2026 · Assigned by mitre