Description
ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ONLYOFFICE | Document Server | < 9.2.1 | 9.2.1 |
Medium · 6.4
CVE-2025-68917
EUVD-2025-205303GHSA-9gpx-4hwh-g499
ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer.
Published Dec 24, 2025 · Updated Dec 24, 2025 · Assigned by mitre