Skip to content
COOEY

FAIL › dossier

onlyoffice

VENDOR

· dossier confidence 20%

ONLYOFFICE is a Ukrainian software vendor whose DocumentServer product suffered two critical RCE vulnerabilities in 2023, revealing significant risks in its JavaScript processing and memory management.

Failure events
4
Zero-days
0
RCEs
3
On KEV
1
Critical
3
Worst shame
75
PROFILE
Categorysoftware vendorWhat they doONLYOFFICE provides open-source office productivity software including document editors, spreadsheets, and presentations. Websitehttps://www.onlyoffice.com ↗
SECURITY POSTURE

The company has a documented history of critical remote code execution vulnerabilities in its DocumentServer product, indicating potential gaps in input validation and memory safety for JavaScript processing.

Notable failures
  • CVE-2023-30186 (RCE via use-after-free)
  • CVE-2023-30187 (RCE via out-of-bounds memory access)
Patterns: critical RCEs in DocumentServer via crafted JavaScript files
FAILURE HISTORY · 4
DATEEVENTSEVSUMMARY
2026-10-08 CVE-2021-3199 high ONLYOFFICE Docs Server suffered a path traversal vulnerability allowing remote code execution via JWT image upload parameters.
2023-08-14 CVE-2023-30186 critical A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.
2023-08-14 CVE-2023-30187 critical An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.
2021-01-26 CVE-2021-3199 critical CVE-2021-3199: Directory traversal with remote code execution can occur in /upload in ONLYOFFIC
SENTIMENT · TRUSTED SOURCES
synthesissevere-fallout-0.60
CVE-2021-3199 represents a critical RCE flaw in ONLYOFFICE's JWT handling, allowing directory traversal via image uploads; while the vendor eventually patched it, the severity of RCE in a document ser
cooey ↗severe-fallout-0.80
NVD entry confirms critical RCE via directory traversal in ONLYOFFICE Document Server before 5.6.3, highlighting the severity of the flaw in a widely deployed document server.
"Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter."
127.0.0.1 ↗severe-fallout+0.00
No substantive coverage; DuckDuckGo bridge returned a connection error, providing no sentiment or stance toward the vendor.
DOSSIER SOURCES
Open questions: What is the exact founding year of ONLYOFFICE? · What is the precise headquarters location of ONLYOFFICE? · What is the current employee count of ONLYOFFICE?
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-08-21 03:58:38.077783+00:00