ONLYOFFICE Docs CVE-2021-3199: exploited path traversal and RCE

On 8 October 2026 CISA added CVE-2021-3199 to its Known Exploited Vulnerabilities (KEV) catalog. The flaw affects ONLYOFFICE Document Server, the server that opens and edits documents in ONLYOFFICE Docs. A path traversal in the /upload endpoint leads to remote code execution on the server. Severity is critical: CVSS 3.1 9.8.

The vulnerability has been public since January 2021 and affects versions before 5.6.3. Its addition to the KEV catalog means CISA has evidence of active exploitation: installations that have fallen behind must be updated as a priority.

What happened

CISA added CVE-2021-3199 to the KEV catalog as “ONLYOFFICE Docs Server Path Traversal Vulnerability” and set 11 October 2026 as the deadline for US federal agencies: three days. In the catalog, use in ransomware campaigns is listed as “unknown”.

The advisory asks organisations to apply mitigations according to the vendor’s instructions, in line with Binding Operational Directive BOD 26-04 on prioritising security updates based on risk and with CISA’s forensics triage requirements. For cloud services the same directive applies; if mitigations are not available, the product must be discontinued. The advisory also asks organisations to assess the internet exposure of every asset.

CISA gives no details on the attacks observed, the attackers or the victims.

Technical details

• CVE: CVE-2021-3199, published on 26 January 2021. The NVD entry was updated on 9 October 2026.
• Product and versions: ONLYOFFICE Document Server before 5.6.3 (CPE configuration: onlyoffice document_server < 5.6.3). The entry’s references include the changelog for version 5.6.3.
• Mechanism: according to the NVD description, a /.. sequence placed in an image upload parameter of the /upload endpoint escapes the intended folder (directory traversal) and allows remote code execution. The description specifies that the issue occurs when JWT is used, the token mechanism the document server uses to authenticate requests.
• Severity: CVSS 3.1 9.8 (critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, both in NIST’s assessment and in a second assessment listed in the entry. The vector describes a network attack of low complexity, with no privileges and no user interaction required, and high impact on confidentiality, integrity and availability. Under CVSS 2 the score is 7.5 (high).
• Weakness: CWE-22 (improper limitation of a pathname to a restricted directory, i.e. path traversal).
• Public code: the NVD entry lists two public proof-of-concept scripts on GitHub (poc_uploadImageFile.py) among its references, tagged as “Exploit”. The details needed to exploit the vulnerability are therefore available to anyone.
• MITRE ATT&CK: for an internet-facing server, exploitation maps to technique T1190, Exploit Public-Facing Application.

Impact for European and Italian companies

The document server processes the files that users open and edit in their browser: contracts, quotes, HR documents. Anyone who runs code on that server can reach the documents passing through it and, depending on how it is installed, use it as a foothold into the rest of the network. If the documents contain personal data, unauthorised access may constitute a personal data breach under the GDPR, to be assessed for notification to the supervisory authority (in Italy, the Garante) within 72 hours.

The age of the vulnerability does not make it less relevant. On-premises installations are often configured once and then forgotten, or managed by an external provider together with the file-sharing platform: that is why versions that are years old can still be in production. The KEV listing tells us someone is looking for them.

For entities in scope of NIS2, the vulnerability falls under vulnerability management and supply chain security: installations managed by third parties must be checked with the provider. A significant incident must be notified to the national CSIRT, which in Italy is CSIRT Italia at the National Cybersecurity Agency (ACN). In healthcare, where documents often contain health data, a compromise of the document server has more serious consequences and the check should be done without delay.

What to do now

1. Take inventory: identify every ONLYOFFICE Document Server instance, including those installed alongside other platforms or managed by providers, and the version of each.
2. Update: bring every instance at least to 5.6.3, the version the NVD entry gives as the limit, and preferably to the latest version supported by the vendor.
3. Reduce exposure: restrict access to the document server to those who really need it; if it does not have to be reachable from the whole internet, put it behind the VPN or the reverse proxy.
4. If you cannot update right away: follow the vendor’s instructions, as CISA asks; if mitigations are not available, take the service offline.
5. Detect: search web server and reverse proxy logs for requests to /upload with /.. sequences, including encoded ones, in the parameters. Check for files created or modified outside the document server’s working folders and for unusual processes started by the service user.
6. If you find signs of exploitation: isolate the server, preserve logs and disk images for forensic analysis before reinstalling, and rotate the keys and secrets configured on the server, including the JWT secret.

How ARXDOME helps

ARX Shield shows open vulnerabilities by machine and by package and highlights those already exploited by attackers, such as the CVEs in the KEV catalog; if a server is suspicious, it lets you isolate it from the network. ARX Expose checks the services your company exposes on the internet, the products it recognises and their known vulnerabilities. ARX Sentry collects logs and events from servers and monitors file integrity in the folders you choose, so out-of-place writes remain visible.

Last updated: 8 October 2026