Vulnerability · Published Jun 12, 2025 · Assigned by SEC-VLab
CVE-2025-5301Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)
Medium 6.1
In plain English
A medium-severity cross-site scripting in Docs (DocumentServer) from OnlyOffice. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 62.4% (higher than 99.2% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)62.4%top 0.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei
Official description
ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OnlyOffice | Docs (DocumentServer) | <=8.3.1 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://r.sec-consult.com/onlyoffice third-party-advisory
- https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#832 release-notes
- https://sec-consult.com/vulnerability-lab/advisory/reflected-cross-site-scripting-in-onlyoffice-docs-documentserver/ exploit
- http://seclists.org/fulldisclosure/2025/Jun/18