CVE-2026-84282

CVE-2026-84282 is a server-side request forgery (SSRF) in the ONLYOFFICE ownCloud Integration plugin version 9.12, where the /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before the ownCloud server makes outbound connections. To trigger it, an authenticated administrator supplies a manipulated 'document server' parameter, causing the server to send requests to attacker-chosen destinations, including localhost and internal network hosts. An attacker gains internal network reconnaissance and can perform TCP port scanning of the ownCloud host's local network by differentiating server responses. Only ownCloud deployments running this integration plugin are affected, and exploitation requires administrative access, so an attacker would typically need a compromised or untrusted admin account. There is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at 0.2% (6th percentile).

What to do: No fixed version is specified in the available data, so check the ONLYOFFICE advisory and CERT/CC VU#943094 for a patched release and update the integration plugin as soon as one is published. In the interim, restrict admin access to the ONLYOFFICE settings page, restrict the Document Server URL to the approved ONLYOFFICE host, and apply egress filtering on the ownCloud server so it cannot probe localhost or arbitrary internal hosts; note CVSS has not yet been scored for this CVE.