CVE-2021-3199 is a path traversal vulnerability (CWE-22) in the /upload endpoint of ONLYOFFICE Document Server, the document editing server used by ONLYOFFICE Docs and by products that integrate it. A /.. sequence in an image upload parameter lets an unauthenticated attacker write files outside the intended directory when JWT is in use, which can lead to remote code execution. CVSS v3.1 score: 9.8 (Critical); NVD also lists CVSS v2 7.5.

The following ONLYOFFICE product versions are affected:

• ONLYOFFICE Document Server versions before 5.6.3, including ONLYOFFICE Docs and platforms that embed an unpatched Document Server

Not affected / patched version:

• ONLYOFFICE Document Server 5.6.3 or later. Current supported releases are strongly recommended, because 5.6.3 is an old release

Successful exploitation may allow attackers to:

• Write files to arbitrary locations on the Document Server and run code on it, without credentials
• Take over the server and access documents it processes, which may include sensitive files from connected platforms such as file sharing, mail and collaboration suites
• Use the compromised server as a foothold into the internal network

CERTVU recommends the following:

1. Upgrade immediately

   Upgrade ONLYOFFICE Document Server to the latest supported release, and at minimum to 5.6.3 or later. Check any product that bundles Document Server, such as collaboration or mail suites, and update it too.

2. Find all instances

3. Restrict exposure

4. Check for compromise

5. Treat this as top priority

   This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog with a federal remediation deadline of 11 October 2026. Rotate the JWT secret and credentials if compromise is suspected, and report to CERTVU.