CVE-2021-3199Published

Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.

Collected exploitation and prediction evidence

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

CVE-2021-3199

Exact risk observation. Current source statements above are a separate evidence layer. Latest risk evidence.

CISA KEV listing collected · added 8 Oct 2026 · ONLYOFFICE · Docs

ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.

CISA source · CISA-cited reference

EPSS unknown / outside the collected prediction scope.

Observed 23 Oct 2026 16:01:26 UTC · Complete immutable risk JSON

cve-program · CVE-2021-3199

Published

Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.

Source published: 22 Jan 2021 02:41:34 UTC
Source modified: 9 Oct 2026 03:55:31 UTC
Observed here: 23 Oct 2026 15:48:27 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.