CVE-2025-64766

MediumCVSS 5.3/10Last modified Oct 18, 2026

Description

NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versions from 22.11 to before 25.05 and versions before Unstable 25.11, a hard-coded secret was used in the NixOS module for the OnlyOffice document server to protect its file cache. An attacker with knowledge of an existing revision ID could use this secret to obtain a document. In practice, an arbitrary revision ID should be hard to obtain. The primary impact is likely the access to known documents from users with expired access. This issue was resolved in NixOS unstable version 25.11 and version 25.05.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published: Nov 17, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-647679.1hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. Prior to version 1.7.5, the public SenderConte CVE-2025-647697.1The Process Optimization application suite leverages connection channels/protocols that by-default are not encrypted and could become subj CVE-2025-64774.8A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as problematic. Affected by this vuln CVE-2025-647706.8The affected products allow unauthenticated access to Open Network Video Interface Forum (ONVIF) services, which may allow an attacker unaut CVE-2025-647728.4The installer of INZONE Hub 1.0.10.3 to 1.0.17.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Li CVE-2025-647733.7In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit CVE-2025-647757.5Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apac CVE-2025-647767.1An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker co CVE-2025-647787.8NMIS/BioDose software V22.02 and previous versions contain executable binaries with plain text hard-coded passwords. These hard-coded passwo CVE-2025-64784.3A vulnerability was found in CodeAstro Expense Management System 1.0. It has been rated as problematic. Affected by this issue is some unkno CVE-2025-647815.1In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1, "External p CVE-2025-647837.8DNG SDK versions 1.7.0 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execu