09 October 2026
Reference: CVE-2021-3199
1. What is being reported?
The vulnerability involves a problem in the way ONLYOFFICE Docs handles image uploads. By sending specially crafted files, attackers can trick the software into running malicious commands on the server. This issue affects versions before 5.6.3 when a security feature called JWT is used.
2. What this means in plain English
If your organisation uses ONLYOFFICE Docs for document management, this flaw could let attackers take control of your system remotely. This could lead to data theft, disruption of services, or further attacks on your network.
3. Could this affect a small business?
Small businesses or charities using ONLYOFFICE Docs, especially versions before 5.6.3 with JWT enabled, could be at risk. If you do not use this software or use a later version, you are likely not affected.
4. What to do now
- Check if your organisation uses ONLYOFFICE Docs and identify the version.
- Contact your IT provider or software supplier to confirm if you are affected and ask about available updates or mitigations.
- Apply all recommended security updates or mitigations from ONLYOFFICE promptly.
- If you use cloud services hosting ONLYOFFICE Docs, ensure your provider follows security update guidelines or consider discontinuing use if mitigations are not available.
5. Ask your IT provider
Can you confirm if our ONLYOFFICE Docs installation is affected by the CVE-2021-3199 vulnerability, and what steps are being taken to mitigate or patch this critical security issue?
6. Bottom line
If you use ONLYOFFICE Docs, act now to check and update your software to prevent hackers from exploiting this critical vulnerability.
Information based on CISA KEV, NVD, and reputable security reporting.