CVE-2021-3199 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2021-01-22

Added to CISA KEV: 2026-10-08 2085 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

⚠️ CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity before patching
IMMEDIATE: Upgrade ONLYOFFICE Document Server to version 5.6.3 or later. This is the definitive fix.
IMMEDIATE: If upgrade is not immediately possible, restrict network access to the Document Server's /upload endpoint via firewall rules or reverse proxy ACLs, limiting access to trusted IP ranges only.
FORENSIC: Review web server access logs for anomalous POST requests to /upload containing '/..', '%2F..', or similar path traversal sequences. Investigate any unexpected files written to server directories.
DETECTION: Deploy WAF rules to detect and block directory traversal sequences (/.. or URL-encoded variants) in multipart upload parameters targeting the /upload endpoint.
MONITORING: Monitor file system integrity on ONLYOFFICE host for unexpected new files, especially in non-upload directories (e.g., /etc, /var, web root outside upload directories).
HARDENING: Ensure ONLYOFFICE runs in a least-privilege container or user context to limit RCE blast radius. If running in Docker, verify container isolation is enforced.
PATCH PRIORITY: CRITICAL — treat as P1 given public PoC availability and internet-facing deployment likelihood.

🔍 Web Intelligence (Kagi · 2026-10-08)

Summary

CVE-2021-3199 is a critical directory traversal vulnerability affecting ONLYOFFICE Document Server versions prior to 5.6.3. When JSON Web Token (JWT) authentication is enabled, an attacker can exploit the `/upload` endpoint by injecting a `/..` sequence into an image upload parameter, potentially leading to remote code execution. This vulnerability is highly significant because it allows unauthenticated or unauthorized attackers to gain control over the affected server, posing a severe risk to the confidentiality, integrity, and availability of document management systems ^[1]^[2].

Exploitation

Active Exploitation: There is evidence of public proof-of-concept (PoC) exploit availability for this vulnerability ^[3].
Threat Actors/Ransomware: Specific information regarding widespread use by ransomware campaigns or named threat actors is not widely documented in standard security databases for this specific CVE.
Prerequisites:

* Network Access: Exploitation is remote. * Authentication: The vulnerability is specifically relevant when JWT is used, but it can be triggered through the upload endpoint. * User Interaction: Generally does not require user interaction, as it is a server-side request processing vulnerability.

Affected Products & Patches

Affected Versions: ONLYOFFICE Document Server versions prior to 5.6.3 ^[1].
Patch Availability: The vulnerability was resolved in version 5.6.3; users are advised to update to the latest available stable version to ensure full protection ^[1].
Mitigations/Workarounds: If an immediate update is not possible, restricting network access to the Document Server to trusted IP addresses can reduce the attack surface. Ensuring that JWT secrets are complex and not exposed is also recommended.

Impact

Access/Capabilities: Successful exploitation grants an attacker the ability to perform directory traversal, which can lead to arbitrary file upload and subsequent remote code execution (RCE) on the host server.
Business Risk: For internet-facing deployments, this vulnerability presents a high risk of total system compromise. An attacker could exfiltrate sensitive documents, modify existing content, or use the compromised server as a pivot point for further lateral movement within the organization's internal network.

Sources

CVE Record: CVE-2021-3199
Vulnerability detail for CVE-2021-3199. Common vulnerabilities and Exposures (CVE) U.S. Department of Homeland Security (DHS) external link Cybersecurity and ... Vulnerability detail for CVE-2021-3199 Description Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Docum…
Directory traversal with remote code execution can occur...
CVE-2021-3199. Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used ...
poc_exploits/CVE-2021-3199/readme.txt at master - GitHub
poc_exploits / CVE-2021-3199 / readme.txt moehw update CVE ID 90666f6 · 6 years ago History 74 lines (54 loc) · 2.57 KB…

🔴 CVE-2021-3199