CVE-2021-3199 – Critical ONLYOFFICE Document Server Path Traversal and Remote Code Execution

CVE-2021-3199 is a Critical, network-exploitable path traversal vulnerability that can lead to remote code execution in ONLYOFFICE Document Server before version 5.6.3 when JWT authentication is enabled.

Key takeaways

Severity: CVSS 9.8 Critical, with network exploitation, no required privileges, and no user interaction.

Affected systems: ONLYOFFICE Document Server versions before 5.6.3 running with JWT enabled, including vulnerable Document Server backends behind ONLYOFFICE Docs.

What changed: CISA added the flaw to the CISA KEV catalog on October 8, 2026, confirming known exploitation. Covered U.S. federal agencies had an October 11, 2026 remediation deadline.

Primary action: Patch every affected instance to 5.6.3 or later, restrict exposure while updating, and investigate for signs of prior compromise.

CVE-2021-3199 Overview: Why an Older ONLYOFFICE Flaw Matters Now

The NVD published CVE-2021-3199 on January 26, 2021, but its operational risk changed materially in October 2026. CISA added the vulnerability to the CISA KEV catalog as the “ONLYOFFICE Docs Server Path Traversal Vulnerability,” with a federal remediation due date of October 11, 2026.

KEV status is materially different from an ordinary vulnerability listing: it indicates that reliable evidence of exploitation in the wild exists. The October 2026 action also coincided with a multinational warning concerning Flax Typhoon activity involving eight known vulnerabilities, five of which were prioritized for urgent federal remediation. CVE-2021-3199 was among those five. The KEV entry independently establishes exploitation of this CVE; attribution of a particular incident to a specific threat actor still requires evidence from the affected environment.

The CISA deadline applies directly to covered U.S. federal civilian agencies rather than every private organization. Even so, organizations running internet-accessible document collaboration infrastructure should treat it as an emergency remediation target.

Technical Details: Path Traversal in the `/upload` Handler

The weakness is classified as CWE-22, an Improper Limitation of a Pathname to a Restricted Directory. It affects image-upload handling in the /upload route when JWT is used.

The vulnerable sequence is straightforward:

An attacker sends a crafted request to the Document Server upload endpoint.
An image-upload parameter contains a /.. sequence that escapes the intended upload path.
Vulnerable path handling allows the request to interact with files outside the expected location.
The upload and file-handling behavior can then be abused to achieve remote code execution.

The published CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It reflects remote, low-complexity exploitation without required privileges or user interaction, with high potential impact to confidentiality, integrity, and availability.

Why JWT does not remove the risk

JWT is part of the vulnerability’s published affected condition, so organizations should identify whether it is enabled rather than assuming the authentication mechanism provides protection. The scoring does not assign required privileges or user interaction, meaning defenders should not lower the priority of a JWT-enabled deployment.

Public proof-of-concept code also reduces the effort required to test or exploit affected servers. Those proofs of concept should only be exercised in an isolated environment with synthetic data—not against production instances.

Severity and Impact: Critical Remote Code Execution

A successful exploit could execute attacker-controlled code with the privileges of the Document Server process. Depending on deployment configuration, that may expose stored documents, encryption or JWT signing material, service credentials, and internal collaboration data. It can also enable persistence, lateral movement, document tampering, and service disruption.

The highest-risk deployments combine three characteristics:

An affected pre-5.6.3 Document Server version.
JWT-enabled authentication.
Direct or indirect exposure of the upload functionality to untrusted networks.

Compromise of the document-processing workload is particularly consequential where it stores or exchanges confidential documents, connects to identity providers, or has broad access to internal services.

Affected ONLYOFFICE Products and Versions

The affected product is ONLYOFFICE Document Server before version 5.6.3 when JWT is used. Organizations operating ONLYOFFICE Docs should determine whether their deployment relies on an affected Document Server backend rather than assuming the Docs interface itself indicates the security status.

Do not rely only on a user-facing version banner. Check container image tags, package manifests, deployment configurations, and software bills of materials to identify every Document Server instance, including workers behind a load balancer. For the full list of affected products and versions, see the CVE-2021-3199 page.

Actionable Insights for Security Teams

1. Confirm exposure immediately

Inventory every Document Server deployment and record its exact version, whether JWT is enabled, and whether the upload endpoint is reachable from untrusted networks. Pay particular attention to older appliances, long-lived containers, shadow IT, and development or demonstration instances that may have escaped normal patch management.

Where possible, identify affected hosts by image digest or package version rather than a human-readable release label. A patched front-end or gateway does not protect an unpatched Document Server worker behind it.

2. Hunt for exploitation evidence

Search reverse-proxy, application, system, and EDR telemetry for requests to /upload containing traversal patterns. Search both raw and decoded requests because proxies, application frameworks, and attackers may encode the same sequence differently:

/upload
../
%2e%2e%2f
%252e%252e%252f

Also look for:

New or modified executable files, scripts, or unusual content in upload, temporary, cache, and service directories.
Unexpected child processes created by Document Server workers.
Configuration changes, newly created services, or persistence mechanisms.
Bursts of failed upload requests followed by successful requests from the same source.
Authentication anomalies involving JWTs, administrative endpoints, or service accounts.

Traversal strings alone are leads rather than proof of compromise. Correlate them with file changes, process execution, and authentication activity.

For key indicators, exploit activity over time, and detailed signal data, see the CVE-2021-3199 page.

3. Escalate positive matches as a security incident

If logs show a successful traversal attempt or suspicious post-exploitation activity, isolate the affected workload while preserving volatile evidence and logs. Capture system, application, proxy, and EDR telemetry before rebuilding or rotating credentials. If compromise is plausible, rotate JWT signing keys and other secrets accessible to the service, and rebuild the host or container from a known-good image.

Deleting an obvious payload does not establish that the server is clean. A rebuilt workload with patched software and rotated exposed credentials provides a more defensible recovery posture.

Remediation and Mitigation Plan

Patch to version 5.6.3 or later. The 5.6.3 release contains the fix. Prefer the latest supported release compatible with the deployment rather than stopping at the minimum fixed version.
Update every Document Server instance. Replace affected containers or packages, verify the running version after deployment, and restart or roll instances so no vulnerable worker remains in service. Test normal document and image workflows after the update.
Reduce exposure while updates are being deployed. Restrict the Document Server API and /upload functionality to required callers and source networks where feasible. If public browser access is architecturally required, enforce authentication at the reverse proxy and filter traversal sequences after URL normalization. Edge filtering is a temporary defense and must not replace the vendor patch.
Reduce the post-exploitation blast radius. Run the service with the minimum required privileges, limit writable paths and Linux capabilities, isolate document workers from sensitive networks, and restrict unnecessary outbound connectivity. Do not disable JWT as a shortcut without validating the security implications of the replacement configuration.
Perform forensic triage and comply with applicable CISA direction. The KEV entry calls for applying vendor mitigations, reviewing internet exposure, and conducting forensic triage. Covered agencies should follow the applicable BOD 26-04 guidance for cloud services or discontinue use where no effective mitigation is available.

References

Bottom Line

CVE-2021-3199 is a Critical, CISA KEV-listed path traversal vulnerability with a CVSS 9.8 remote code execution impact. Upgrade every affected ONLYOFFICE Document Server instance to 5.6.3 or later, restrict exposure during the update, and investigate for compromise. Do not treat JWT authentication or edge filtering as a substitute for the vendor patch.

#CVE20213199 #ONLYOFFICE #ONLYOFFICEDocs #DocumentServer #Critical #RCE #PathTraversal #CISAKEV #CWE22