CVE-2021-3199: ONLYOFFICE Docs

Vendor: ONLYOFFICE
Product: Docs
Vulnerability: ONLYOFFICE Docs Server Path Traversal Vulnerability
Date added: Oct 8, 2026
CISA due date (U.S. federal agencies): Oct 11, 2026
Known ransomware campaign use: Unknown
Weakness (CWE): CWE-22

References

NVD — CVE-2021-3199
github.com
www.cisa.gov
www.cisa.gov
nvd.nist.gov

This site summarizes CISA's catalog for information only. It is not security advice — follow your vendor's guidance and official advisories.

Last updated: Oct 9, 2026 11:13 UTC · Catalog version 2026.10.08

About this page

ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.