---
title: "ONLYOFFICE Docs CVE-2021-3199: Old Upload RCE Now in KEV"
url: https://erroneo.us/security/briefs/onlyoffice-document-server-path-traversal-cve-2021-3199/
description: "Path traversal in ONLYOFFICE Document Server before 5.6.3 allows file write and RCE. Used by China-linked actors in 2026; in CISA KEV. Upgrade old instances."
type: security-brief
section: "Security Digest"
date_published: 2021-01-22
date_modified: 2026-10-08
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2021-3199"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# ONLYOFFICE Docs CVE-2021-3199: Old Upload RCE Now in KEV

**Verdict: Check exposure.** Only Document Server installs older than 5.6.3, a release from August 2020, are at risk, but any you find should be treated as exposed and upgraded or pulled offline today.

- **Who must act:** Anyone self-hosting ONLYOFFICE Document Server (Docs) 5.6.2 or older, alone or behind Nextcloud, ownCloud, Seafile, Confluence, Moodle or another connector, especially internet-reachable instances with JWT enabled.
- **Who can relax:** Teams on Document Server 5.6.3 or later (10.0.0 is current), and teams that do not run their own ONLYOFFICE Docs server.
- **Affected:** ONLYOFFICE Document Server before 5.6.3 when JWT is used (CVE record); Document Server 5.1.5 through 5.6.2 (joint advisory AA26-281A)
- **Fixed:** ONLYOFFICE Document Server 5.6.3 (tagged Aug 17, 2020) and later; Current release: 10.0.0 (Oct 12, 2026)
- **CVEs:** CVE-2021-3199
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Find every Document Server you run: docker ps and docker image ls for onlyoffice/documentserver, or dpkg -l / rpm -q onlyoffice-documentserver.
2. Upgrade anything older than 5.6.3 to a current release; if that is not possible today, take the instance off the internet.
3. Set a long random JWT secret and rotate it in every connected app (Nextcloud, ownCloud, Seafile and others); never keep the old default value secret.
4. Restrict who can reach the Document Server to the integrating apps and users that need it.
5. If an old instance was internet-facing, treat it as compromised: rebuild it and rotate the JWT secret and credentials it held.

### How to check if you are affected

- Search web logs for POST requests to /upload/ containing ../ sequences, followed by requests to /docbuilder.
- Verify package files, especially the docbuilder binary under /var/www/onlyoffice/documentserver/server/FileConverter/bin/ (dpkg -V or rpm -V onlyoffice-documentserver).
- Look for unexpected child processes or outbound connections from the document server's converter and docservice processes.
- Hunt for the web shells listed in AA26-281A (b374.php, back.pl, error.jsp, file_back.aspx, gf.phtml, yaml-payload.jar) and unusual upload volume from the host.

## What happened

CVE-2021-3199 is a directory traversal in the `/upload` endpoint of ONLYOFFICE Document Server (ONLYOFFICE Docs), the self-hosted editing engine behind many collaboration suites. Per the [CVE record](https://www.cve.org/CVERecord?id=CVE-2021-3199), published January 22, 2021, a `/..` sequence in an image upload parameter lets an attacker write files outside the intended directory and reach remote code execution "when JWT is used." ONLYOFFICE had already fixed it in 5.6.3, tagged August 17, 2020. The [changelog](https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563) entry reads: "Fix Path Traversal vulnerability via image upload params." Versions 5.6.1 and 5.6.2 closed two other path traversals just before it. CISA's ADP scores it CVSS 3.1 9.8.

The bug came back into view on October 8, 2026. A [joint advisory, AA26-281A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a), from the FBI, CISA, NSA and agencies in the UK, Australia, Canada, Japan, New Zealand and Spain lists it among eight CVEs that actors using Integrity Technology Group infrastructure successfully exploited. CISA describes Integrity Tech as a China-based company with government ties. It says the actors' tradecraft matches activity tracked as Flax Typhoon, Ethereal Panda and Red Juliett, against [government, critical manufacturing, healthcare, law enforcement and education](https://www.cisa.gov/news-events/news/cisa-fbi-nsa-and-international-partners-warn-china-based-cybersecurity-company-enabling-threat) targets. The same day CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3199) with an October 11 deadline. [HKCERT](https://www.hkcert.org/security-bulletin/onlyoffice-docs-remote-code-execution-vulnerability_20261009) followed with a high-risk bulletin on October 9.

## Who is affected

Document Server before 5.6.3 is affected. AA26-281A lists 5.1.5 through 5.6.2. Instances often sit behind other products, because ONLYOFFICE ships [connectors](https://www.onlyoffice.com/all-connectors.aspx) for Nextcloud, ownCloud, Seafile, Confluence, SharePoint, Moodle and dozens more. A collaboration stack set up in 2020 and never touched again may still run an affected server. The current release is [10.0.0](https://github.com/ONLYOFFICE/DocumentServer/releases/tag/v10.0.0) (October 12, 2026).

## Do you really need to act?

Only if you run an old Document Server, but then without delay. A fixed release has been out for more than six years, so affected instances are by definition unmaintained. That is exactly what the actors in AA26-281A hunt for, alongside years-old ProFTPD, Struts and Pulse Secure bugs.

The JWT condition does not offer much protection. The [public proof of concept](https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.py) signs its token with the literal string `secret`. It overwrites the server's `docbuilder` binary through the traversal, then calls the `/docbuilder` endpoint to run a reverse shell. In the 5.6-era Docker image, the [startup script](https://github.com/ONLYOFFICE/Docker-DocumentServer/blob/e47d6d8c1ac3ab215acdf4beda0679ae8c7e15f9/run-document-server.sh) left JWT off by default and fell back to `JWT_SECRET=secret` when an operator turned it on without setting one. Current images enable JWT with a random secret. An old install with a strong custom secret is harder to hit, but you should not bet on it.

## What to do now

1. Inventory: `docker ps --format '{{.Image}}' | grep -i onlyoffice`, `dpkg -l onlyoffice-documentserver` or `rpm -q onlyoffice-documentserver`. Also check the "document server" URL configured in each connected app.
2. Upgrade anything older than 5.6.3 to a current release, for example by pulling a current `onlyoffice/documentserver` image and recreating the container with its data volumes.
3. If you cannot upgrade today, firewall the server so only the integrating apps can reach it, or shut it down.
4. Set a long random JWT secret and update it in every connector.
5. If an affected instance was reachable from the internet, rebuild it rather than patching in place, and rotate the secrets it held.

## How to tell if you were hit

Search the nginx logs in front of Document Server for POSTs to `/upload/` containing `../`, followed by requests to `/docbuilder`. Verify package files with `dpkg -V onlyoffice-documentserver` or `rpm -V onlyoffice-documentserver`, paying attention to `/var/www/onlyoffice/documentserver/server/FileConverter/bin/`. Look for shells or network tools spawned by the converter or docservice processes, and for outbound connections from the host. AA26-281A also lists web shells to hunt for (`b374.php`, `back.pl`, `error.jsp`, `file_back.aspx`, `gf.phtml`, `yaml-payload.jar`) and advises watching for unusual upload volume from servers that normally send little.

## Timeline

- Aug 17, 2020 — ONLYOFFICE tags Document Server 5.6.3 with the fix.
- Jan 22, 2021 — CVE-2021-3199 is published. The record links public proof-of-concept code.
- Oct 8, 2026 — Joint advisory AA26-281A names the CVE among exploited bugs, and CISA adds it to KEV with an October 11 due date ([coverage](https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.html)).
- Oct 9, 2026 — HKCERT issues a high-risk bulletin.
- Oct 12, 2026 — ONLYOFFICE releases Document Server 10.0.0.

## Sources

1. [ONLYOFFICE / GitHub — DocumentServer CHANGELOG, 5.6.3](https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563)
2. [CVE record — CVE-2021-3199](https://www.cve.org/CVERecord?id=CVE-2021-3199)
3. [CISA — Known Exploited Vulnerabilities: CVE-2021-3199](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3199)
4. [CISA, FBI, NSA et al. — AA26-281A: Chinese government-linked cyber threat actors combine automated and hands-on hacking tools](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a)
5. [CISA — Warning on China-based cybersecurity company enabling threat actors](https://www.cisa.gov/news-events/news/cisa-fbi-nsa-and-international-partners-warn-china-based-cybersecurity-company-enabling-threat)
6. [Public proof of concept — poc_uploadImageFile.py (CVE-2021-3199)](https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.py)
7. [ONLYOFFICE / GitHub — Docker-DocumentServer run-document-server.sh (5.6.0 image tags)](https://github.com/ONLYOFFICE/Docker-DocumentServer/blob/e47d6d8c1ac3ab215acdf4beda0679ae8c7e15f9/run-document-server.sh)
8. [ONLYOFFICE / GitHub — DocumentServer v10.0.0 release](https://github.com/ONLYOFFICE/DocumentServer/releases/tag/v10.0.0)
9. [ONLYOFFICE — Connectors for ONLYOFFICE Docs](https://www.onlyoffice.com/all-connectors.aspx)
10. [HKCERT — ONLYOFFICE Docs remote code execution vulnerability (Oct 9, 2026)](https://www.hkcert.org/security-bulletin/onlyoffice-docs-remote-code-execution-vulnerability_20261009)
11. [The Hacker News — Flax Typhoon exploits five flaws as CISA sets October 11 deadline](https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.html)

---
Source page: https://erroneo.us/security/briefs/onlyoffice-document-server-path-traversal-cve-2021-3199/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt