Mmastodon TechnologyCybersecurity first seen 1 d ago, last 1 d ago, peak #4

High-severity flaw found in ONLYOFFICE Document Server

Original: ONLYOFFICE Document Server has a high-severity flaw (CVE-2026-110385): a Document Builder request can overwrite its own

ONLYOFFICE Document Server has a high-severity vulnerability, tracked as CVE-2026-110385. A malicious Document Builder request can overwrite the server's own configuration file and execute commands on the host. Every self-hosted version before 10.0 is affected. The fix is to upgrade to version 10.0 and enable inbound token validation. Security communities are circulating the advisory and urging self-hosted deployments to patch quickly.

Why now: Admins of self-hosted ONLYOFFICE instances are being warned to patch a flaw that allows remote command execution on their servers.

ONLYOFFICECVE-2026-110385

Open on mastodon →

Evidence

• ONLYOFFICE Document Server has a high-severity flaw (CVE-2026-110385): a Document Builder request can overwrite its own config file and run commands on the server. Affects every self-hosted version before 10.0. Fix: upgrade to 10.0 and enable inbound token validation. https://… · suriq@infosec.exchange · 2

API: https://socialmediatrends-api.osmike.com/v1/trends/2176147