CVE-2021-3199 ONLYOFFICE Docs Server Path Traversal

Exploited in the wild Critical 9.8 Published 22 Jan 2021 Updated 9 Oct 2026

Attacker can achieve remote code execution via directory traversal in image upload parameter when JWT is enabled.

Exploited in the wild: Since 8 Oct 2026
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-3199?

CVE-2021-3199 is a critical path traversal vulnerability in n/a, published on 22 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.

Weakness: CWE-22

Which versions are affected by CVE-2021-3199?

It affects 1 product.

Products include Onlyoffice Document Server.

How do I fix CVE-2021-3199?

No fix has been published for CVE-2021-3199 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 11 Oct 2026.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2021-3199 being exploited?

Yes. Attackers have exploited CVE-2021-3199 in the wild since at least 8 Oct 2026.

Sources

Also known as GHSA-vm8r-r39c-96c6.