Description
ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ONLYOFFICE | Document Server | < 9.2.1 | 9.2.1 |
Medium · 6.4
CVE-2025-68935
EUVD-2025-205393GHSA-wxxw-j7jh-6gvh
ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer.
Published Dec 25, 2025 · Updated Dec 26, 2025 · Assigned by mitre