CVE-2021-3199
CRITICALCVSS 3.1 · 9.8 · NIST NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.
CISA KEV: known exploited
Added: 2026-10-08 · Due: 2026-10-11
Known ransomware use: Unknown
EPSS: 30.24% · Percentile: 98.2%
As of 2026-10-27
EPSS estimates exploitation probability over the next 30 days. KEV due dates apply to US federal civilian agencies. Confirm your affected versions in vendor advisories.
CWE: CWE-22 · Published: 2021-01-26T18:16:28.507 · Modified: 2026-10-09T14:20:47.350
Sources: NIST NVD, CISA KEV, FIRST EPSS. NVD and EPSS cached up to 6 hours; KEV up to 12 hours.
All CVSS assessments
- CVSS 3.1: 9.8 (CRITICAL) · NIST NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1: 9.8 (CRITICAL) · 134c704f-9b21-4f2e-91b3-4a467353bcc0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0: 7.5 (HIGH) · NIST NVD
AV:N/AC:L/Au:N/C:P/I:P/A:P
References and fixes
- https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563
- https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.py
- https://github.com/nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.py
- https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563
- https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.py
- https://github.com/nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.py
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3199