CVE-2026-110652

Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated SSRF in ONLYOFFICE DocumentServer via downloadfile endpoint

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in the default configuration. Attackers can submit a crafted request body containing an internal or loopback URL, which is treated as a DIRECT request skipping private-address filtering, causing the server to fetch and proxy back arbitrary private-network and cloud metadata content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110652

EUVD

EUVD-2026-101034

Affected Vendors & Products

Vendor	Product	Version / Range
ONLYOFFICE	DocumentServer	2.5.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability is an unauthenticated Server-Side Request Forgery (SSRF) in ONLYOFFICE DocumentServer versions before 10.0.0. It affects the /downloadfile/:docid endpoint and allows attackers to bypass private-IP request filtering by exploiting the isInJwtToken flag when JWT verification is disabled. Attackers can submit crafted requests with internal or loopback URLs, causing the server to fetch and proxy arbitrary private-network and cloud metadata content.

Detection Guidance

To detect this vulnerability, monitor network traffic for unusual requests to the /downloadfile/:docid endpoint with internal or loopback URLs. Check server logs for requests bypassing private-IP filtering. Use tools like curl to test if the server processes crafted requests with the isInJwtToken flag when JWT is disabled.

Impact Analysis

An attacker could exploit this to access sensitive internal systems, retrieve cloud metadata, or exfiltrate data from private networks. If the server has access to internal resources, attackers might gain unauthorized access to confidential information or internal services.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations may face compliance breaches, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately upgrade ONLYOFFICE DocumentServer to version 10.0.0 or later to address the vulnerability. Disable the isInJwtToken flag if not required and ensure JWT verification is enabled. Restrict network access to the /downloadfile/:docid endpoint and monitor for suspicious activity.

Hi! I’m here to help you understand CVE-2026-110652. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70