High 8.7Published Oct 14, 2026

CVE-2026-110385A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system comm…

Updated under an hour ago (2026-10-19 09:00 UTC)

Does this affect you?

It affects ONLYOFFICE Document Server. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 1.04%, higher than 63% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for ONLYOFFICE Document Server

Exploited in the last 30 days

A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled converter XML supplied through the optional third argument of builder.SaveFile(). By injecting a duplicate m_sFileTo element, an attacker can override the server-generated output path and write arbitrary content outside the designated job directory. This allows the attacker to overwrite the runtime.json configuration file, modify the Document Builder executable path and arguments, and execute arbitrary commands when a subsequent Document Builder job is processed.

CVSS: 8.7 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-73
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 1.04% (percentile 63)
Assigned by: mitre
NVD analysis: Awaiting Analysis
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

ONLYOFFICE Document Server onlyoffice:document_server (from the name)	before 10.0	CNA record

References

https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.