CVE-2025-5301
Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)
- State
- Published
- Severity
- 6.1 Medium
- Published
- Jun 12, 2025
- Updated
- Jun 18, 2025
- Reserved
- May 28, 2025
Description
ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.1 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
Docs (DocumentServer)OnlyOffice |
|
References
- https://r.sec-consult.com/onlyofficethird-party-advisory
- https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#832release-notes
- https://sec-consult.com/vulnerability-lab/advisory/reflected-cross-site-scripting-in-onlyoffice-docs-documentserver/exploit
- http://seclists.org/fulldisclosure/2025/Jun/18
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.