CVE-2021-3199: ONLYOFFICE Docs Server Path Traversal Vulnerability
ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.
Overview
ONLYOFFICE Document Server before version 5.6.3 contains a path traversal flaw in its image upload endpoint. By injecting /.. sequences into the upload parameter, an attacker can direct the server to write a file to an arbitrary location on the filesystem rather than the intended upload directory. Placing a malicious file in an executable path produces remote code execution on the host. The vulnerability is described as occurring when JWT is in use, though the exact role of that configuration in exploitation is not fully settled by available sources.
Vulnerability details
The /upload endpoint in ONLYOFFICE Document Server fails to sanitize the image upload parameter before constructing the destination file path. When a user-supplied value contains /.. traversal sequences, the server resolves the path outside the intended upload directory without rejecting or normalizing the input. This is a classic CWE-22 (Path Traversal) condition: the application trusts attacker-controlled path components to determine where a file lands on disk, giving the attacker write access to arbitrary filesystem locations.
An attacker sends a crafted HTTP POST request to the /upload endpoint, embedding /.. sequences in the image upload parameter alongside a malicious file payload such as a web shell or server-side script. The server writes that file to an attacker-chosen path. If the chosen path falls within a directory from which the server executes code, the attacker achieves remote code execution on the Document Server host. The vulnerability is described as occurring in JWT-configured deployments; whether a valid JWT token is needed to reach the endpoint is not settled by the available sources, so the precise authentication requirement should be verified against the deployment configuration.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor web server or application logs for POST requests to the /upload endpoint whose path or filename parameters contain /.. sequences or URL-encoded equivalents (%2F%2E%2E, %2e%2e%2f). These patterns have no legitimate use in image upload filenames.
- Audit the filesystem for newly created files in directories outside the designated upload path, particularly in web-accessible or script-executable directories. File creation events in those locations with timestamps correlating to /upload requests are a strong indicator of exploitation.
Remediation
Additional hardening
- Upgrade ONLYOFFICE Document Server to version 5.6.3 or later, which is the first release containing the fix for this path traversal vulnerability.
- Restrict network access to the /upload endpoint using a reverse proxy or firewall rule so that only trusted internal hosts or authenticated sessions can reach it, reducing exposure on internet-facing deployments.
- Apply filesystem-level controls so the account running Document Server has write access only to the designated upload directory and read-only or no access to web-executable paths, limiting the impact of any traversal write.
- Conduct a forensic review of the upload directory and adjacent web-accessible paths for unexpected files, particularly scripts, and correlate creation timestamps against web access logs to identify prior exploitation attempts.
Key dates
References
- https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2021-3199
- https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.py
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3199
Frequently asked questions
Does CVE-2021-3199 affect my FedRAMP authorization?
If ONLYOFFICE Docs runs inside your authorization boundary, yes. CVE-2021-3199 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of October 11, 2026, a date that has already passed. For a FedRAMP-authorized service, an unpatched KEV in the boundary is an assessor finding. An overdue one is a finding your assessor and sponsoring agency can see right now. Your options are to remediate it immediately or formally document the mitigation and the delay.
How does Knox help me handle CVE-2021-3199?
Knox does not patch your software. Remediating ONLYOFFICE Docs is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus Knox's automated continuous monitoring platform and audit-artifact coverage that document the fix for your next assessment. Applying the patch is yours to do; managing your compliance posture while you do it is not something you handle on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on a continuous basis. When something like CVE-2021-3199 surfaces, exposure appears during ongoing monitoring rather than waiting until an assessor flags it at review time.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2021-3199's remediation deadline of October 11, 2026 has passed. What happens now?
If CVE-2021-3199 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the finding out and documenting why the deadline was missed is what keeps your authorization intact and the agency relationship in good standing.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
