CVE-2025-64766

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-11-17

Last updated on: 2025-11-17

Assigner: GitHub, Inc.

Description

NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versions from 22.11 to before 25.05 and versions before Unstable 25.11, a hard-coded secret was used in the NixOS module for the OnlyOffice document server to protect its file cache. An attacker with knowledge of an existing revision ID could use this secret to obtain a document. In practice, an arbitrary revision ID should be hard to obtain. The primary impact is likely the access to known documents from users with expired access. This issue was resolved in NixOS unstable version 25.11 and version 25.05.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-17

Last Modified

2025-11-17

Generated

2026-07-06

AI Q&A

2025-11-18

EPSS Evaluated

2026-07-05

NVD

CVE-2025-64766

EUVD

EUVD-2025-197878

Affected Vendors & Products

Vendor	Product	Version / Range
nixos	onlyoffice	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability in NixOS's Onlyoffice involves a hard-coded secret used in the module for the OnlyOffice document server to protect its file cache. An attacker who knows an existing revision ID could use this secret to access a document. Although obtaining an arbitrary revision ID is difficult, the vulnerability primarily allows access to known documents even after user access has expired.

Impact Analysis

The main impact of this vulnerability is unauthorized access to documents that a user previously had access to, even after their access has expired. This could lead to exposure of sensitive or confidential information if an attacker knows the revision ID of a document.

Mitigation Strategies

To mitigate this vulnerability, upgrade NixOS Onlyoffice to version 25.05 or later, or to unstable version 25.11 or later, where the hard-coded secret issue has been resolved.

Hi! I’m here to help you understand CVE-2025-64766. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70