Metraipolis › archive › dc_7efcbf64a635

KEV CVE-2021-3199: ONLYOFFICE Docs — ONLYOFFICE Docs Server Path Traversal Vulnerability

Source: CISA KEV
Original: https://nvd.nist.gov/vuln/detail/CVE-2021-3199
License (as archived): CC0-1.0
Archived: 2026-10-17T15:29:11.526Z
SHA-256 of the archived text: 1d3d65e6a51577df4b661b56f03818280e748ac392464fdb1149577634a4182a
Stable URL of this page: https://metraipolis.com/documento/dc_7efcbf64a635

How to cite

KEV CVE-2021-3199: ONLYOFFICE Docs — ONLYOFFICE Docs Server Path Traversal Vulnerability — CISA KEV, https://nvd.nist.gov/vuln/detail/CVE-2021-3199 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_7efcbf64a635 (Metraipolis archive dc_7efcbf64a635, sha256 1d3d65e6a51577df4b661b56f03818280e748ac392464fdb1149577634a4182a)

BibTeX

@misc{dc7efcbf64a635,
  title = {KEV CVE-2021-3199: ONLYOFFICE Docs — ONLYOFFICE Docs Server Path Traversal Vulnerability},
  howpublished = {CISA KEV},
  url = {https://nvd.nist.gov/vuln/detail/CVE-2021-3199},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_7efcbf64a635; sha256 1d3d65e6a51577df4b661b56f03818280e748ac392464fdb1149577634a4182a},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: CISA KEV, https://nvd.nist.gov/vuln/detail/CVE-2021-3199. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

CVE-2021-3199 è nel catalogo CISA delle vulnerabilità SFRUTTATE attivamente (Known Exploited Vulnerabilities), aggiunta il 2026-10-08.
Prodotto: ONLYOFFICE Docs — ONLYOFFICE Docs Server Path Traversal Vulnerability
Descrizione: ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.
Azione richiesta (agenzie federali USA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Scadenza: 2026-10-11.
Uso noto in campagne ransomware: Unknown
Debolezze: CWE-22
Note e riferimenti: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2021-3199

Fonte: catalogo CISA KEV (CC0 1.0), versione 2026.10.16, consultato il 2026-10-17: https://www.cisa.gov/known-exploited-vulnerabilities-catalog