CVE-2025-5301: Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)

Q: What is the severity of CVE-2025-5301?

CVE-2025-5301 is rated as a high severity reflected XSS vulnerability.

Q: How do I fix CVE-2025-5301?

To fix CVE-2025-5301, upgrade ONLYOFFICE Docs (DocumentServer) to version 8.3.2 or later.

Q: What versions are affected by CVE-2025-5301?

CVE-2025-5301 affects ONLYOFFICE Docs (DocumentServer) versions 8.3.1 and below.

Q: What type of vulnerability is CVE-2025-5301?

CVE-2025-5301 is a reflected cross-site scripting (XSS) vulnerability.

Q: What is the impact of exploiting CVE-2025-5301?

Exploiting CVE-2025-5301 can allow attackers to inject and execute malicious scripts on user browsers.

Published Jun 12, 2025

Updated

ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.

Affected Software

1 affected component

ONLYOFFICE Docs (DocumentServer)<=8.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ONLYOFFICE Docs (DocumentServer) to a version that resolves this vulnerability.
Fixed in 8.3.2

Event History

Jun 12, 2025

CVE Published

via MITRE·07:59 AM

Data Sourced

via MITRE·07:59 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·08:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-5301?

CVE-2025-5301 is rated as a high severity reflected XSS vulnerability.

How do I fix CVE-2025-5301?