Vulnerability · Published Oct 8, 2026 · Assigned by VulnCheck

CVE-2026-107781Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById

High 7.4

In plain English

A high-severity server-side request forgery in skyeye from dromara. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.3%top 72.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server fetch internal URLs and overwrite any user's stored file, then read results via queryFileToShowById.

Affected products (as reported)

Vendor	Product	Versions
dromara	skyeye	0 – through 003549ae5615bd114ba5bb8ddf6a8e8ead97c321

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

GitHub Issue #29 issue-tracking
https://github.com/dromara/skyeye/blob/003549ae5615bd114ba5bb8ddf6a8e8ead97c321/skyeye-adm/adm-pro/src/main/java/com/skyeye/eve/diskcloud/service/impl/FileConsoleServiceImpl.java#L533-L556 technical-description
https://github.com/dromara/skyeye product
VulnCheck Advisory: Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById third-party-advisory