CVE-2026-110385: ONLYOFFICE Document Server vulnerability
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled converter XML supplied through the optional third argument of builder.SaveFile(). By injecting a duplicate msFileTo element, an attacker can override the server-generated output path and write arbitrary content outside the designated job directory. This allows the attacker to overwrite the runtime.json configuration file, modify the Document Builder executable path and arguments, and execute arbitrary commands when a subsequent Document Builder job is processed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ONLYOFFICE Document Serverto a version that resolves this vulnerability.Fixed in 10.0.0
Event History
Frequently Asked Questions
Which deployments are exposed?
ONLYOFFICE Document Server versions before 10.0.0 are affected. Exploitation requires access to the Document Builder API and a valid Inbox-compatible JWT, so an unauthenticated remote attacker is not described as able to trigger it.
What privileges would successful exploitation provide?
Commands execute as the ds service account. The attacker can use the arbitrary file-write condition to alter runtime.json and change the Document Builder executable path and arguments.
Is command execution triggered as part of the initial file write?
The overwritten configuration takes effect when a subsequent Document Builder job is processed. An attacker therefore needs a later Document Builder job to trigger the modified executable configuration.
What input must be controlled for exploitation?
The attacker must supply user-controlled converter XML through the optional third argument to builder.SaveFile(). The exploit uses a duplicate m_sFileTo element to replace the server-generated output path.