Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
CISA added five Flax Typhoon-exploited flaws to the KEV catalog, with a federal patch deadline of October 11.
86
CVE-2021-3199
Path Traversal RCE in ONLYOFFICE Document Server
CISA: ONLYOFFICE Docs Server Path Traversal Vulnerability
- CVSS 3.1
- 9.8 critical
- EPSS
- 30%p98
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
ONLYOFFICE Document Server before 5.6.3 has a directory-traversal flaw (CWE-22) in the /upload function that can lead to remote code execution. When JWT is in use, a remote attacker can trigger it by placing a /.. sequence in an image-upload parameter, with no authentication or user interaction required. Successful exploitation can fully compromise confidentiality, integrity, and availability of the server (CVSS 3.1 base score 9.8). Self-hosted ONLYOFFICE Docs / Document Server installations older than 5.6.3 are affected. CISA added the issue to the Known Exploited Vulnerabilities catalog on 2026-10-08, public proof-of-concept code is available, and ransomware use is listed as unknown.
What to do: Upgrade ONLYOFFICE Document Server (ONLYOFFICE Docs) to version 5.6.3 or later and prioritize any internet-facing instances under CISA BOD 26-04. If a vendor fix cannot be applied, discontinue use of the product. Because this CVE is in the KEV catalog, review upload and application logs and the host for signs of path traversal or unexpected code execution and treat exposed unpatched servers as potentially compromised.
| Product | Affected |
|---|---|
| ONLYOFFICE Document Server (ONLYOFFICE Docs) | before 5.6.3 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.
KEVCISA Known Exploited Vulnerability
- Affected
- ONLYOFFICE Docs
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Vendors
- onlyoffice
- Products
- document server
- Weakness
- CWE-22
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
6 storiesFBI disrupts Chinese hacking tools used to breach critical infrastructure
FBI seized Flax Typhoon domains for tools used in critical-infrastructure intrusions.
86
US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwide
FBI seized seven Flax Typhoon-linked domains as seven governments warned of PRC data theft.
82
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
Joint advisory says Integrity Technology Group-enabled Chinese actors steal data from critical infrastructure using botnets and hands-on hacking.
82
FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails
FBI and six countries say China-linked Integrity Technology Group stole emails and shared them via a third-party portal.
79
U.S. CISA adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND flaws to its Known Exploited Vulnerabilities catalog
CISA added five exploited ProFTPD, ONLYOFFICE, Strapi, Struts, and BIND flaws to the KEV catalog.
78