Description
ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ONLYOFFICE | Document Server | < 9.2.1 | 9.2.1 |
Medium · 6.4
CVE-2025-68936
EUVD-2025-205392GHSA-v55r-6gfm-698m
ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.
Published Dec 25, 2025 · Updated Dec 26, 2025 · Assigned by mitre