CVE-2026-107781: Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server fetch internal URLs and overwrite any user's stored file, then read results via queryFileToShowById.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it. No account or user interaction is required, although exploitation has high attack complexity.
What capabilities does exploitation provide?
An attacker can control the URL fetched by the server, enabling requests to internal URLs. They can also overwrite any user's stored file using the supplied key parameter and read the resulting content through queryFileToShowById.
Which component should be investigated for exposure?
Investigate the OnlyOffice save callback endpoint editUploadOfficeFileById in Dromara Skyeye, along with the queryFileToShowById functionality that can expose overwritten file contents. The affected code is present through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321.