CVE-2026-84282Disclosure

LOWCVSS 6.5 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated administrator can manipulate the document server parameter to cause the ownCloud server to send arbitrary requests to attacker-controlled destinations, including localhost and internal network hosts. This allows internal network reconnaissance and TCP port scanning based on differences in server responses.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification2 categories

Disclosure

150.0%

Patch

150.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Daily CyberSecurity@Daily_CyberSec46d
Disclosure
A new ONLYOFFICE ownCloud plugin SSRF vulnerability, tracked as CVE-2026-84282, allows attackers to trigger unauthorized internal network requests. #ONLYOFFICE #ownCloud #SSRF #Cybersecurity #CVE202684282 #Vulnerability https://securityonline.info/onlyoffice-owncloud-plugin-ssrf/ https://t.co/t027asEZWu
Post summary
A newly discovered SSRF vulnerability (CVE-2026-84282) in the ONLYOFFICE ownCloud plugin is disclosed, allowing unauthorized internal network requests.
00020459
13.0K followersView on X
OJOBIT@0J0BIT46d
Patch
recommended mitigation is blunt: disable or remove the plugin until an update ships, and apply network-level egress controls to limit outbound connections from the ownCloud server to authorized destinations only > CVE-2026-84282 in ONLYOFFICE's ownCloud plugin 9.12 lets an authenticated admin convert the file server into an SSRF relay for internal port scans > VU#943094 documents an unpatched SSRF in ONLYOFFICE ownCloud plugin 9.12 > an authenticated administrator can coerce ONLYOFFICE's ownCloud integration plugin, version 9.12, into firing arbitrary outbound network requests from the ownCloud > version 9.12 of Ascensio System SIA's connector trusts administrator-supplied document server URLs > CVE-2026-84282 covers the issue > when the plugin verifies a document server configuration, it makes the connection directly from the ownCloud host https://news.ojobit.com/story/onlyoffice-owncloud-plugin-ssrf-cve-2026-84282-a4b85e
Post summary
The message describes an SSRF flaw in ONLYOFFICE’s ownCloud plugin 9.12 and advises disabling the plugin and tightening outbound traffic as mitigation steps.
0000022
15 followersView on X

Explore more

Back to dashboard