CVE-2026-110652

Medium

Description

ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in the default configuration. Attackers can submit a crafted request body containing an internal or loopback URL, which is treated as a DIRECT request skipping private-address filtering, causing the server to fetch and proxy back arbitrary private-network and cloud metadata content.

SeverityMedium

CVSS4.0

Exploit probability—

ProductDocumentServer

PublishedOct 14, 2026

First seenOct 14, 2026

Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Update

ONLYOFFICE DocumentServer10.0.0 or later

Patches

github.com/ONLYOFFICE/DocumentServer/releases/tag/v10.0.0

Vendor advisories

github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#1000

Affected products

Product	Affected versions	Fixed in
ONLYOFFICE DocumentServer	2.5.0 ≤ v < 10.0.0	10.0.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.