CVE-2026-84282: A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12)
A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated administrator can manipulate the document server parameter to cause the ownCloud server to send arbitrary requests to attacker-controlled destinations, including localhost and internal network hosts. This allows internal network reconnaissance and TCP port scanning based on differences in server responses.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated ownCloud administrator. The vulnerable endpoint is /apps/onlyoffice/ajax/settings/address.
What can an attacker make the server do?
An authenticated administrator can supply a manipulated Document Server URL that causes the ownCloud server to initiate outbound requests to attacker-controlled destinations, including localhost and internal network hosts. Response differences can be used for internal network reconnaissance and TCP port scanning.
How can I determine whether my deployment is affected?
The affected component identified is the ONLYOFFICE ownCloud Integration plugin version 9.12. Review whether that plugin version is deployed and whether administrator accounts can access the settings address endpoint.