← Vulnerability feed

Vulnerability record · CVE-2021-25831 · published 1 March 2021

CVE-2021-25831: Onlyoffice document server vulnerability

Onlyoffice · Document Server

A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. An attacker must request the conversion of the crafted file from PPTT into PPTX format. Using the chain of two other bugs related to improper string handling, a remote attacker can obtain remote code execution on DocumentServer.

9.8 CVSS 3.1 Critical EPSS 12% · top 4.1%
9.8CVSS 3.1 base score, v2 7.5
12%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. An attacker must request the conversion of the crafted file from PPTT into PPTX format. Using the chain of two other bugs related to improper string handling, a remote attacker can obtain remote code execution on DocumentServer.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/ONLYOFFICE/DocumentServer Product
https://github.com/ONLYOFFICE/core ProductVendor Advisory
https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L1918 Vendor Advisory
https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L241 Vendor Advisory
https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/PPTXFormat/Logic/Fills/BlipFill.cpp#L328 Vendor Advisory
https://github.com/merrychap/poc_exploits/tree/master/ONLYOFFICE/CVE-2021-25831 ExploitVendor Advisory
https://github.com/ONLYOFFICE/DocumentServer Product
https://github.com/ONLYOFFICE/core ProductVendor Advisory
https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L1918 Vendor Advisory
https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L241 Vendor Advisory
https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/PPTXFormat/Logic/Fills/BlipFill.cpp#L328 Vendor Advisory
https://github.com/merrychap/poc_exploits/tree/master/ONLYOFFICE/CVE-2021-25831 ExploitVendor Advisory

Track CVE-2021-25831 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-30186Onlyoffice document server use after free vulnerabilityA use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScri…EPSS 2.3%9.8CVE-2023-30187Onlyoffice document server out-of-bounds write vulnerabilityAn out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via craft…EPSS 2.4%9.8CVE-2022-29776Onlyoffice core out-of-bounds write vulnerabilityOnlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack overflow via the component DesktopEditor/c…EPSS 6.9%9.8CVE-2022-29777Onlyoffice core out-of-bounds write vulnerabilityOnlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via the component DesktopEditor/fo…EPSS 6.9%9.8CVE-2021-25830Onlyoffice document server vulnerabilityA file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13. An attacker must request the conversion…EPSS 12%9.8CVE-2021-25832Onlyoffice document server out-of-bounds write vulnerabilityA heap buffer overflow vulnerability inside of BMP image processing was found at [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v6.0.0. Using th…EPSS 13%9.8CVE-2021-25833Onlyoffice document server path traversal vulnerabilityA file extension handling issue was found in [server] module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21. The file extension is controlled by an…EPSS 44%9.8CVE-2021-3199Onlyoffice document server path traversal vulnerabilityDirectory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence …EPSS 8.2%

Source: NIST National Vulnerability Database (record CVE-2021-25831), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.