ONLYOFFICE Docs CVE-2021-3199: Old Upload RCE Now in KEV

What to do

1. Find every Document Server you run: docker ps and docker image ls for onlyoffice/documentserver, or dpkg -l / rpm -q onlyoffice-documentserver.
2. Upgrade anything older than 5.6.3 to a current release; if that is not possible today, take the instance off the internet.
3. Set a long random JWT secret and rotate it in every connected app (Nextcloud, ownCloud, Seafile and others); never keep the old default value secret.
4. Restrict who can reach the Document Server to the integrating apps and users that need it.
5. If an old instance was internet-facing, treat it as compromised: rebuild it and rotate the JWT secret and credentials it held.

How to check if you are affected or compromised

• Search web logs for POST requests to /upload/ containing ../ sequences, followed by requests to /docbuilder.
• Verify package files, especially the docbuilder binary under /var/www/onlyoffice/documentserver/server/FileConverter/bin/ (dpkg -V or rpm -V onlyoffice-documentserver).
• Look for unexpected child processes or outbound connections from the document server's converter and docservice processes.
• Hunt for the web shells listed in AA26-281A (b374.php, back.pl, error.jsp, file_back.aspx, gf.phtml, yaml-payload.jar) and unusual upload volume from the host.

What happened#

CVE-2021-3199 is a directory traversal in the /upload endpoint of ONLYOFFICE Document Server (ONLYOFFICE Docs), the self-hosted editing engine behind many collaboration suites. Per the CVE record, published January 22, 2021, a /.. sequence in an image upload parameter lets an attacker write files outside the intended directory and reach remote code execution "when JWT is used." ONLYOFFICE had already fixed it in 5.6.3, tagged August 17, 2020. The changelog entry reads: "Fix Path Traversal vulnerability via image upload params." Versions 5.6.1 and 5.6.2 closed two other path traversals just before it. CISA's ADP scores it CVSS 3.1 9.8.

The bug came back into view on October 8, 2026. A joint advisory, AA26-281A, from the FBI, CISA, NSA and agencies in the UK, Australia, Canada, Japan, New Zealand and Spain lists it among eight CVEs that actors using Integrity Technology Group infrastructure successfully exploited. CISA describes Integrity Tech as a China-based company with government ties. It says the actors' tradecraft matches activity tracked as Flax Typhoon, Ethereal Panda and Red Juliett, against government, critical manufacturing, healthcare, law enforcement and education targets. The same day CISA added the CVE to the KEV catalog with an October 11 deadline. HKCERT followed with a high-risk bulletin on October 9.

Who is affected#

Document Server before 5.6.3 is affected. AA26-281A lists 5.1.5 through 5.6.2. Instances often sit behind other products, because ONLYOFFICE ships connectors for Nextcloud, ownCloud, Seafile, Confluence, SharePoint, Moodle and dozens more. A collaboration stack set up in 2020 and never touched again may still run an affected server. The current release is 10.0.0 (October 12, 2026).

Do you really need to act?#

Only if you run an old Document Server, but then without delay. A fixed release has been out for more than six years, so affected instances are by definition unmaintained. That is exactly what the actors in AA26-281A hunt for, alongside years-old ProFTPD, Struts and Pulse Secure bugs.

The JWT condition does not offer much protection. The public proof of concept signs its token with the literal string secret. It overwrites the server's docbuilder binary through the traversal, then calls the /docbuilder endpoint to run a reverse shell. In the 5.6-era Docker image, the startup script left JWT off by default and fell back to JWT_SECRET=secret when an operator turned it on without setting one. Current images enable JWT with a random secret. An old install with a strong custom secret is harder to hit, but you should not bet on it.

What to do now#

1. Inventory: docker ps --format '{{.Image}}' | grep -i onlyoffice, dpkg -l onlyoffice-documentserver or rpm -q onlyoffice-documentserver. Also check the "document server" URL configured in each connected app.
2. Upgrade anything older than 5.6.3 to a current release, for example by pulling a current onlyoffice/documentserver image and recreating the container with its data volumes.
3. If you cannot upgrade today, firewall the server so only the integrating apps can reach it, or shut it down.
4. Set a long random JWT secret and update it in every connector.
5. If an affected instance was reachable from the internet, rebuild it rather than patching in place, and rotate the secrets it held.

How to tell if you were hit#

Search the nginx logs in front of Document Server for POSTs to /upload/ containing ../, followed by requests to /docbuilder. Verify package files with dpkg -V onlyoffice-documentserver or rpm -V onlyoffice-documentserver, paying attention to /var/www/onlyoffice/documentserver/server/FileConverter/bin/. Look for shells or network tools spawned by the converter or docservice processes, and for outbound connections from the host. AA26-281A also lists web shells to hunt for (b374.php, back.pl, error.jsp, file_back.aspx, gf.phtml, yaml-payload.jar) and advises watching for unusual upload volume from servers that normally send little.

Timeline#

• Aug 17, 2020 — ONLYOFFICE tags Document Server 5.6.3 with the fix.
• Jan 22, 2021 — CVE-2021-3199 is published. The record links public proof-of-concept code.
• Oct 8, 2026 — Joint advisory AA26-281A names the CVE among exploited bugs, and CISA adds it to KEV with an October 11 due date (coverage).
• Oct 9, 2026 — HKCERT issues a high-risk bulletin.
• Oct 12, 2026 — ONLYOFFICE releases Document Server 10.0.0.

Vulnerability records

• CVE-2021-3199 · KEV 2026-10-08 · Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /..

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. ONLYOFFICE / GitHub — DocumentServer CHANGELOG, 5.6.3 github.com
2. CVE record — CVE-2021-3199 cve.org
3. CISA — Known Exploited Vulnerabilities: CVE-2021-3199 cisa.gov
4. CISA, FBI, NSA et al. — AA26-281A: Chinese government-linked cyber threat actors combine automated and hands-on hacking tools cisa.gov
5. CISA — Warning on China-based cybersecurity company enabling threat actors cisa.gov
6. Public proof of concept — poc_uploadImageFile.py (CVE-2021-3199) github.com
7. ONLYOFFICE / GitHub — Docker-DocumentServer run-document-server.sh (5.6.0 image tags) github.com
8. ONLYOFFICE / GitHub — DocumentServer v10.0.0 release github.com
9. ONLYOFFICE — Connectors for ONLYOFFICE Docs onlyoffice.com
10. HKCERT — ONLYOFFICE Docs remote code execution vulnerability (Oct 9, 2026) hkcert.org

Coverage and analysis

1. The Hacker News — Flax Typhoon exploits five flaws as CISA sets October 11 deadline thehackernews.com