Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck

CVE-2026-110652ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass

Medium 4.0

In plain English

A medium-severity server-side request forgery in DocumentServer from ONLYOFFICE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)4.0Medium

Exploit odds (30 days)0.4%top 65.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in the default configuration. Attackers can submit a crafted request body containing an internal or loopback URL, which is treated as a DIRECT request skipping private-address filtering, causing the server to fetch and proxy back arbitrary private-network and cloud metadata content.

Affected products (as reported)

Vendor	Product	Versions
ONLYOFFICE	DocumentServer	2.5.0 – before 10.0.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

References

Vendor Patch patch
Vendor Release-Notes issue-tracking, release-notes
VulnCheck Advisory: ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass third-party-advisory