CVE-2021-3199: ONLYOFFICE Document Server Path Traversal RCE (KEV)
CVE-2021-3199 is a directory-traversal vulnerability in ONLYOFFICE Document Server before 5.6.3: when JWT is used, a /.. sequence in an image-upload parameter to the /upload endpoint lets a remote attacker write outside the intended directory and achieve remote code execution, and CISA added this flaw to the Known Exploited Vulnerabilities catalog on 2026-10-08.
Vulnerability summary
| Vulnerability ID | CVE-2021-3199 |
|---|---|
| CVSS score | 9.8 |
| EPSS score | 0.3024 |
| CISA KEV | Yes — in the Known Exploited Vulnerabilities catalog |
| Source | NVD |
| Published | 2021-01-26T18:16:28.507 |
Affected components
| Component | CPE | Version range |
|---|---|---|
| ONLYOFFICE Document Server | cpe:2.3:a:onlyoffice:document_server:*:*:*:*:*:*:*:* | All versions before 5.6.3 (fixed in 5.6.3) |
What this means
CVE-2021-3199 is a path-traversal vulnerability (CWE-22) in ONLYOFFICE Document Server. NVD's description states: "Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter" (NVD).
NVD records a CVSS v3.1 score of 9.8 (critical, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), agreed by both the NVD primary scoring and a secondary CNA submission — network-reachable, low attack complexity, no privileges or user interaction required, high impact across confidentiality, integrity and availability (NVD).
The fix landed in ONLYOFFICE Document Server 5.6.3; the project's own changelog for that release lists under back-end fixes: "Fix Path Traversal vulnerability via image upload params (Bug #46113)" (ONLYOFFICE DocumentServer CHANGELOG, v5.6.3).
CISA added CVE-2021-3199 to the KEV catalog on 2026-10-08, due date 2026-10-11 under Binding Operational Directive 26-04, and lists known ransomware campaign use as "Unknown" (CISA KEV).
As of 2026-10-26, FIRST scores the probability of exploitation at 0.3024 (98.209th percentile) — well above the median for a five-year-old flaw, consistent with renewed scanning now that it carries a KEV listing (FIRST EPSS).
Any ONLYOFFICE Document Server instance older than 5.6.3 should be upgraded immediately, with particular attention to self-hosted deployments that expose the /upload endpoint directly to the internet.
Evidence
- Directory traversal with remote code execution in /upload when JWT is used, via a /.. sequence in an image upload parameter, affecting versions before 5.6.3. — NVD
- CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, agreed by both NVD primary and a secondary CNA submission. — NVD
- The 5.6.3 release changelog records the back-end fix: "Fix Path Traversal vulnerability via image upload params (Bug #46113)". — ONLYOFFICE DocumentServer CHANGELOG, v5.6.3
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-08, due date 2026-10-11, known ransomware campaign use listed as Unknown. — CISA KEV
- EPSS score is 0.3024 (98.209th percentile) as of 2026-10-26. — FIRST EPSS