ONLYOFFICE Document Server RCE exploited (CVE-2021-3199)

Actively exploited in the wild - CVE-2021-3199 is a critical directory traversal and remote code execution flaw in ONLYOFFICE Document Server before 5.6.3 that lets an unauthenticated network attacker write files outside the intended upload directory and execute code. Update to 5.6.3 or later immediately, since exploitation is confirmed and no authentication is required.

Overview

ONLYOFFICE Document Server is the backend engine many teams run behind Nextcloud, ownCloud, and self-hosted collaboration suites to edit documents in the browser. CVE-2021-3199 lives in the /upload endpoint. When the server is configured to use JWT for request signing, an attacker can slip a /.. sequence into an image upload parameter and escape the intended upload directory.

The JWT requirement is what makes this easy to overlook. Administrators often assume that signed requests mean only trusted callers can reach /upload, so the endpoint gets less scrutiny. The traversal sequence rides inside an otherwise valid request, and the server resolves the path before validating where it lands.

Impact

Successful exploitation gives an unauthenticated attacker two things at once: arbitrary file write outside the upload folder, and remote code execution on the host. Because the flaw sits before authentication is meaningfully enforced, no account, token, or user interaction is needed. CVSS scores it 9.8 with a network attack vector, low complexity, and no privileges required.

In practice, a compromised Document Server is a serious pivot point. It typically sits on the internal network with access to document storage, and it may hold JWT secrets used to authenticate with the collaboration platform in front of it. The CISA KEV catalog lists CVE-2021-3199 as confirmed exploited, and EPSS gives it an 8.2 percent probability of exploitation in the next 30 days, well above the baseline for most CVEs.

Remediation and Mitigation

• Upgrade ONLYOFFICE Document Server to 5.6.3 or later. This is the only complete fix.
• If you cannot patch immediately, block or tightly restrict external access to /upload. Only trusted application servers should reach it.
• Rotate JWT secrets after upgrading, on the assumption that credentials may have leaked during any exposure window.
• Check web server logs for /upload requests containing .. sequences, especially from unfamiliar source addresses.
• Review the Document Server filesystem for unexpected files or recently modified scripts, and treat any finding as a potential compromise.

Teams that run self-hosted collaboration stacks should pair this with a review of other exposed internal services. Historical breach reports are catalogued at breach reports, and ongoing coverage of exploited CVEs is available at security news.

Security Insight

CVE-2021-3199 is a reminder that signing a request is not the same as validating its contents. JWT was treated as a gate, but the path parameter was still parsed and trusted, which is a recurring pattern in document and file-handling services where convenience APIs outpace input checks. The fact that this flaw reached CISA KEV and continues to see exploitation years after the 5.6.3 fix speaks to how long self-hosted collaboration servers linger unpatched behind perimeter defenses, quietly holding secrets that make them worth the effort.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs