EXPOSURES › CVE-2021-3199
CVE-2021-3199
HIGH ⌖ ON CISA KEV · EXPLOITEDONLYOFFICE Docs Server suffered a path traversal vulnerability allowing remote code execution via JWT image upload parameters.
The vulnerability allowed attackers to execute arbitrary code by manipulating image upload parameters with a /.. sequence, leading to remote code execution. DIB organizations must ensure their document processing platforms are patched and monitored for similar path traversal flaws, as unpatched vulnerabilities can lead to severe data breaches and compliance failures.
Shame score — The vulnerability was actively exploited in the wild and allowed remote code execution, indicating a significant security oversight in input validation and sandboxing.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.