CVE-2025-5301

ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#832
https://r.sec-consult.com/onlyoffice
http://seclists.org/fulldisclosure/2025/Jun/18
https://sec-consult.com/vulnerability-lab/advisory/reflected-cross-site-scripting-in-onlyoffice-docs-documentserver/

Configurations

No configuration.

History

No history.

Information

Published : 2025-06-12 08:15

Updated : 2026-06-17 09:47

NVD link : CVE-2025-5301

Mitre link : CVE-2025-5301

CVE.ORG link : CVE-2025-5301

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-5301", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5301", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-12T13:45:27.605229Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "affectedData": [{"vendor": "OnlyOffice", "product": "Docs (DocumentServer)", "versions": [{"status": "affected", "version": "<=8.3.1"}], "defaultStatus": "unaffected"}]}], "published": "2025-06-12T08:15:23.603", "references": [{"url": "https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#832", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}, {"url": "https://r.sec-consult.com/onlyoffice", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}, {"url": "http://seclists.org/fulldisclosure/2025/Jun/18", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://sec-consult.com/vulnerability-lab/advisory/reflected-cross-site-scripting-in-onlyoffice-docs-documentserver/", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response."}, {"lang": "es", "value": "ONLYOFFICE Docs (DocumentServer) en versiones iguales o inferiores a la 8.3.1 se ve afectado por un problema de cross-site scripting (XSS) al abrir archivos mediante el protocolo WOPI. Los atacantes podr\u00edan inyectar scripts maliciosos mediante solicitudes HTTP POST manipuladas, que posteriormente se reflejan en la respuesta HTML del servidor."}], "lastModified": "2026-06-17T09:47:38.483", "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf"}