CVE-2025-64766: NixOS has hardcoded credentials in Onlyoffice module
NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versions from 22.11 to before 25.05 and versions before Unstable 25.11, a hard-coded secret was used in the NixOS module for the OnlyOffice document server to protect its file cache. An attacker with knowledge of an existing revision ID could use this secret to obtain a document. In practice, an arbitrary revision ID should be hard to obtain. The primary impact is likely the access to known documents from users with expired access. This issue was resolved in NixOS unstable version 25.11 and version 25.05.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64766?
The severity of CVE-2025-64766 is classified as high due to the presence of a hard-coded secret which can compromise security.
How do I fix CVE-2025-64766?
To fix CVE-2025-64766, upgrade to NixOS Onlyoffice version 25.05 or later.
Which versions are affected by CVE-2025-64766?
CVE-2025-64766 affects NixOS Onlyoffice versions from 22.11 to before 25.05 and versions before Unstable 25.11.
What is the impact of CVE-2025-64766?
The impact of CVE-2025-64766 includes potential unauthorized access to sensitive documents due to the hard-coded secret.
Has CVE-2025-64766 been patched?
Yes, CVE-2025-64766 has been addressed in later versions of NixOS Onlyoffice post 25.05.