ONLYOFFICE Docs Path Traversal and Remote Code Execution (CVE-2021-3199)

Catalog analysis: CISA added this entry on October 08, 2026. The entry reflects catalog information retrieved on October 08, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2021-3199 is a path traversal vulnerability (CWE-22) identified in ONLYOFFICE Docs. The flaw exists within an image upload parameter where the use of a /.. sequence can allow an attacker to traverse directories. If successful, this vulnerability could lead to remote code execution (RCE) on the affected server.

Exposure and applicability

This vulnerability is applicable to installations of ONLYOFFICE Docs that utilize JSON Web Tokens (JWT) for authentication/authorization. The exposure path is specifically tied to the image upload functionality. Because this may involve an open-source component or third-party library, organizations should evaluate whether this implementation is present in their specific deployment or integrated into other proprietary products.

Remediation priorities

Based on our analysis, vulnerability management teams should prioritize assets based on internet exposure and the presence of JWT configurations. We recommend the following actions:

1. Apply Vendor Mitigations: The primary corrective action is to apply mitigations as specified in the vendor’s instructions. This should be the highest priority for all exposed instances.
2. Identify Affected Components: Since this may affect open-source components or libraries, infrastructure owners should audit their environment for any third-party implementations of ONLYOFFICE Docs beyond standard installations.
3. Evaluate JWT Usage: Determine if JWT is enabled and active, as the vulnerability occurs when this specific authentication method is used.

How to validate remediation

To ensure that exposure has been reduced, defenders should move beyond simple version checks. Validation should include:

• Configuration Audit: Confirming that the mitigations prescribed by the vendor are active and correctly configured in the production environment.
• Verification of Fix Application: Ensuring that the specific updates addressing CVE-2021-3199 have been deployed across all instances, including those integrated into other products.

It is important to note that a successful update does not automatically guarantee security; validation must confirm that the mitigation is functioning as intended within the specific environment’s architecture.

Limits and open questions

There are several unknowns regarding this vulnerability. It is currently unknown if this flaw has been utilized in known ransomware campaigns. Additionally, while CISA has provided a due date for federal agencies, this timeline does not automatically apply to private sector organizations. Residual risk remains if the vulnerability exists within a third-party library that is not updated simultaneously with the main ONLYOFFICE Docs application.

Source and editorial note

CVE-2021-3199: ONLYOFFICE Docs Server Path Traversal Vulnerability · Source date: October 08, 2026 · Retrieved October 08, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment