ONLYOFFICE Docs: CVE-2021-3199 path traversal under active attack

What it is and who is affectedCVE-2021-3199 is a path traversal flaw (CWE-22) in ONLYOFFICE Docs, the self-hosted document suite many organisations ru...

What it is and who is affected

CVE-2021-3199 is a path traversal flaw (CWE-22) in ONLYOFFICE Docs, the self-hosted document suite many organisations run to edit spreadsheets, text files and presentations collaboratively. According to the NVD of NIST, the problem sits in the /upload endpoint of ONLYOFFICE Document Server and can be triggered when JWT authentication is in use, by sending a /.. sequence inside an image upload parameter. The consequence is directory traversal that can lead to remote code execution.

The affected range is precise: ONLYOFFICE Document Server versions before 5.6.3. The vulnerability was published on the NVD on 26 January 2021 and carries a CVSS 3.1 score of 9.8, CRITICAL (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning it can be reached over the network without privileges or user interaction. In practice, any SME, online shop or small IT team in Barcelona, Lleida, Tarragona or Girona that still runs an old Document Server instance exposed to the internet should treat this as a live risk, not a historical footnote.

Why it is urgent: already exploited in real attacks

This is not a theoretical bug. CISA added CVE-2021-3199 to its Known Exploited Vulnerabilities (KEV) catalogue on 8 October 2026, which means there is confirmed evidence of exploitation in the wild. The US agency gave federal agencies until 11 October 2026 to remediate it, applying mitigations in line with the vendor's instructions and under its BOD 26-04 guidance on risk-based security updates, including forensics triage requirements. Where mitigations are unavailable, the guidance is to discontinue use of the product.

The material does not record known use in ransomware campaigns, so we will not claim otherwise. But the combination of a critical score, a public proof-of-concept referenced in the advisory and confirmed real-world exploitation is more than enough reason to act. Note too that the age of the CVE is a trap: old versions of self-hosted software often survive for years in corners of an infrastructure that nobody audits.

What to do today

Inventory first. Check whether ONLYOFFICE Docs is deployed at all, on which servers, and in which version. Look beyond the main site: test environments, staging copies and forgotten virtual machines count.
Update to a fixed release. The NVD states that versions before 5.6.3 are affected; apply the update indicated in the vendor's advisory and release notes rather than assuming a specific build. If you cannot update immediately, follow the mitigation instructions published by the vendor.
Look for signs of intrusion. Review web server and application logs for suspicious requests to the upload endpoint containing traversal sequences, unexpected files written outside the intended directories, or unusual outbound connections. CISA's guidance explicitly asks for forensics triage.
Reduce internet exposure. If the document server does not need to be reachable from the open internet, put it behind a VPN or an access-controlled reverse proxy. Evaluate each asset's exposure, as the BOD 26-04 guidance recommends, and keep JWT configuration consistent with the vendor's hardening advice.
Patch the rest of the stack. A single forgotten component is rarely alone. Review the update status of the CMS, the server operating system and the libraries in use.

How a cybersecurity team such as ALMC's can help

For an SME or an online shop with a small IT team, keeping track of CVEs, vendor advisories and KEV updates is a job in itself. At ALMC we work on exactly that layer: security audits and pentesting to find vulnerabilities before someone exploits them, server hardening, monitoring and incident response, and maintenance and updating of WordPress, PrestaShop and Joomla installations. When a site has already been compromised, we also handle the repair and cleanup.

In a case like CVE-2021-3199, the practical work is unglamorous but decisive: locating every instance of the product, confirming versions, applying the vendor's fix, reviewing logs for traces of exploitation and closing whatever remains reachable from outside. All of it aligned with GDPR obligations, because a compromised document server can expose files that contain personal data. The earlier that loop is closed, the less it costs in euros, downtime and reputation.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.