PT-2025-25284 · Onlyoffice · Onlyoffice Docs

Published 2025-02-14 · Updated 2025-12-06 · CVE-2025-5301

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions ONLYOFFICE Docs (DocumentServer) versions 8.3.1 and earlier

Description ONLYOFFICE Docs (DocumentServer) is susceptible to a reflected cross-site scripting (XSS) issue when handling files through the WOPI protocol. An attacker can inject malicious scripts by sending specially crafted HTTP POST requests. These requests are then reflected in the server’s HTML response, potentially allowing for the execution of arbitrary code in the context of a user’s browser. The issue stems from a lack of proper sanitization of the web page structure.

Recommendations ONLYOFFICE Docs (DocumentServer) versions prior to 8.3.1 are affected. Update ONLYOFFICE Docs (DocumentServer) to a version later than 8.3.1.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-06823

CVE-2025-5301

Affected Products

Onlyoffice Docs

References · 16

• 🔥 https://sec-consult.com/vulnerability-lab/advisory/reflected-cross-site-scripting-in-onlyoffice-docs-documentserver · Exploit
• https://bdu.fstec.ru/vul/2025-06823 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-5301 · Security Note
• https://osv.dev/vulnerability/CVE-2025-5301 · Vendor Advisory
• https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#832 · Note
• https://t.me/cvenotify/126041 · Telegram Post
• https://twitter.com/CVEnew/status/1933084173285073199 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/1997123862765654230 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1933081239528841723 · Twitter Post
• https://twitter.com/dailycve/status/1993082326775902212 · Twitter Post
• https://r.sec-consult.com/onlyoffice · Note
• http://seclists.org/fulldisclosure/2025/Jun/18 · Note
• https://twitter.com/dailycve/status/1970246692344672388 · Twitter Post
• https://t.me/cvenotify/125497 · Telegram Post
• https://t.me/cvetracker/26074 · Telegram Post