CVE-2026-110652: ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass
ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in the default configuration. Attackers can submit a crafted request body containing an internal or loopback URL, which is treated as a DIRECT request skipping private-address filtering, causing the server to fetch and proxy back arbitrary private-network and cloud metadata content.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ONLYOFFICE DocumentServerto a version that resolves this vulnerability.Fixed in 10.0.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
ONLYOFFICE DocumentServer deployments before 10.0.0 are exposed when JWT verification is disabled, which the advisory identifies as the default configuration. The affected endpoint is reachable remotely and does not require authentication.
What does an attacker need to exploit it?
An attacker needs network access to the /downloadfile/:docid endpoint and must send a crafted request body containing an internal or loopback URL. No credentials or user interaction are required.
What could an attacker access through the vulnerable server?
The server can be induced to fetch and proxy arbitrary private-network content and cloud metadata content. This includes resources normally protected by the private-IP request filtering agent.
What should be done if an immediate upgrade is not possible?
Enable JWT verification to prevent the described isInJwtToken bypass condition. Restrict remote access to the /downloadfile/:docid endpoint where possible until the deployment can be updated to 10.0.0 or later.