CVE-2025-5301
Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)
Vexday Risk Score
40Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 6.1EPSS 34.9%KEV nãoPoC —Nuclei simMetasploit —Patch —
Lifecycle
12 Jun 2025Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
OnlyOffice · Docs (DocumentServer)Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →