Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)
OnlyOffice · Docs (DocumentServer)
The reflected cross-site scripting flaw lives in ONLYOFFICE Docs (DocumentServer) in versions up to and including 8.3.1, where the server reflects unsanitised input from crafted HTTP POST requests into its HTML response when files are opened via the WOPI protocol. An attacker who can get a victim to interact with a crafted request (network-reachable, no authentication required, but requiring user interaction) could inject and execute malicious scripts in the victim's browser session.
ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 12 Jun 2025. No public exploit code or confirmed exploitation is recorded.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.