ONLYOFFICE Docs, CVE-2021-3199: on CISA's exploited list

The bottom line

If you run ONLYOFFICE Docs (Document Server) with JWT on, act now: CISA's date of 11 October 2026 has already passed. First find out whether it runs anywhere and which version; before 5.6.3 is affected. If you do not run it, stop reading.

Free analysis report · 8 pagesONLYOFFICE Docs, CVE-2021-3199: on CISA's exploited listThe same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

At a glance

Does this apply to you?

What it is

The record says an attacker can send a crafted image upload request to the server's /upload path. A /.. sequence in a parameter lets it step outside the intended folder (CWE-22). The record says this can lead to remote code execution, meaning the attacker runs commands on the server.

Exposure by situation

These priorities are our judgement from what the sources say about who can use the flaw and how. They are not vendor ratings.

Things people will get wrong

• "It is a 2021 flaw, so it is long dead." CISA lists it as exploited, and any copy still before 5.6.3 stays in range however old the record is.
• "JWT is on, so uploads are protected." The record names JWT use as the condition under which the flaw occurs, not as a protection.
• "We use it through another product, so it is not ours." The sources do not say how it is packaged. Ask your provider whether a copy runs on your behalf.

How we would triage it

This is our judgement.

The commands only read: they print a version or list what is installed. They come from general knowledge of this kind of product, not from the sources, so check them against the vendor's page before you run them. Words in capitals are for you to fill in.

Step 1: Find the versions you run

• Ask your IT provider or supplier whether ONLYOFFICE Docs or Document Server runs anywhere on your estate.
• Record each version, as the record names versions before 5.6.3.

docker ps --format '{{.Names}} {{.Image}}' | grep -i onlyoffice
dpkg -l | grep -i onlyoffice
rpm -qa | grep -i onlyoffice

Step 2: Reduce exposure

• Take any affected copy off the internet, or limit access to the people who need it, until it is updated.
• Do this first for copies that people outside your firm can reach.

Step 3: Update

• Move to a current release from the vendor. The sources name no fixed version beyond the record's "before 5.6.3", so get the target from the vendor.
• Ask for the new version in writing.

Step 4: Check for signs of misuse

• Review web server and application logs for upload requests containing /.. sequences.
• If any are found, treat the server as possibly compromised and involve your provider.

To close it, read the version from the product itself, not from an old inventory, and save the output with the date. If you cannot update today, write down who owns it, the new date, and what limits exposure until then.

Send this to your IT provider

Copy it, change the names and dates, and send it. It is a draft for you to check, not a template tested with any provider.

Hello, CISA lists CVE-2021-3199, a path traversal flaw in ONLYOFFICE Docs (Document Server) that the record says can allow remote code execution when JWT is used. The record names versions before 5.6.3 as affected. Please tell us whether we run it anywhere, directly or through a supplier, and which version. If so, please update it and check its logs for unusual upload requests. Please confirm the version and the fix in writing by a date you suggest this week. Thank you.

Signs it was used

An update closes the hole. It does not tell you whether someone used it first. CISA's required action points to its forensic triage requirements (BOD 26-04). Look for:

• Upload requests in web or application logs whose paths contain /.. sequences.
• Files in the server's program folders that you did not put there or that changed unexpectedly.
• Unexpected outbound connections from the document server.

The weakness behind it

CISA's entry classes this as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

• CWE-22: Improper Limitation of a Pathname to a Restricted Directory →What this kind of mistake is, and which exploited vulnerabilities share it.

The sources, in their words

CISA's catalogue entry:

ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.

The CVE record, published by Mitre on 22 January 2021:

Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.

The record gives no version ranges. Use the vendor's advisory for the affected versions.

CISA's required action:

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).

What we do not know yet

• The sources do not name a fixed version or what the fix changed.
• The sources do not say how attacks were carried out in practice or who was targeted.
• It is not stated whether a default or weak JWT secret is needed for an attack to work.
• We have not tested this against any environment. Versions and scores are as the sources state them and as at 1 November 2026; the vendor's advisory wins where it differs.
• The sections headed "The bottom line", "Does this apply to you?", "What it is", "Exposure by situation", "Things people will get wrong", "How we would triage it" and "Send this to your IT provider" are our interpretation of the sources, not a statement by CISA or the vendor.

• Today's mission →Every exploited vulnerability from the last seven days, in the order their deadlines fall.
• The CVE Triage Handbook →How to check, analyse and triage a CVE. Free with registration.