Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-84282

ONLYOFFICE ownCloud integration plugin · Vulnerability

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-84282

Published

A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated administrator can manipulate the document server parameter to cause the ownCloud server to send arbitrary requests to attacker-controlled destinations, including localhost and internal network hosts. This allows internal network reconnaissance and TCP port scanning based on differences in server responses.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-84282

Published

ONLYOFFICE ownCloud integration plugin

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Ascensio System SIA / OnlyOffice",
                    "product": "ONLYOFFICE ownCloud integration plugin",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "9.12"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON