CVE-2025-5301CWE-79

Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)

Medium · published June 12, 2025

Patch now

High probability of exploitation

CVSS calls it medium at 6.1. It sits in the 99.2th percentile for exploit probability.

CVSS v3.1
6.1
EPSS
62%
Percentile
99.2
In the wild
Unconfirmed
What it is

ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.62356 · 99.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-06-12T07:59Z
EPSS history
Timeline
  • 15 SEP 03:18Z
    EPSS moved 46% → 62%
    epss
  • 14 SEP 03:20Z
    EPSS moved 46% → 62%
    epss
  • 12 JUN 07:59Z
    Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)
    cvelistv5