CVE-2021-3199

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Oct 9, 2026

Description

Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563Release Notes, Third Party Advisory
https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.pyExploit, Third Party Advisory
https://github.com/nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.pyExploit, Third Party Advisory
https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563Release Notes, Third Party Advisory
https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.pyExploit, Third Party Advisory
https://github.com/nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.pyExploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3199US Government Resource

Timeline

Published: Jan 26, 2021
Last modified: Oct 9, 2026
Added to CISA KEV: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-319967.5An issue was discovered in the algorithmica crate through 2021-03-07 for Rust. There is a double free in merge_sort::merge().CVE-2021-319977.8A UNIX Symbolic Link (Symlink) Following vulnerability in python-postorius of openSUSE Leap 15.2, Factory allows local attackers to escalate CVE-2021-319987.8A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise Server 11-SP3; openSUSE Backports SLE-15-SP2,CVE-2021-319998.8A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as others users in the clu CVE-2021-32003.3Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver * testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, c CVE-2021-320007.1A UNIX Symbolic Link (Symlink) Following vulnerability in the clone-master-clean-up.sh script of clone-master-clean-up in SUSE Linux Enterpr CVE-2021-320016.5K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confident CVE-2021-320023.3Improper Access Control vulnerability in web service of Secomea SiteManager allows local attacker without credentials to gather network info CVE-2021-320035.5Unprotected Transport of Credentials vulnerability in SiteManager provisioning service allows local attacker to capture credentials if the s CVE-2021-320045.3This issue affects: Secomea GateManager All versions prior to 9.6. Improper Check of host header in web server of Secomea GateManager allows CVE-2021-320055.4Cross-site Scripting (XSS) vulnerability in log view of Secomea SiteManager allows a logged in user to store javascript for later execution.CVE-2021-320064.3This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Permission Issues vulnerability in LinkManager web por