Skip to content
Heist/ feed
Back to feed
Medium

Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)

Type: advisorySources: OSV

ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-5301
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 01:24 UTC · Revision 1

Source evidence

Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)

core-osv · Original source

Published 12 Jun 2025, 07:59 UTC

ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.

osv:CVE-2025-5301
Complete source record
{
  "id": "e3adfd41da1cdcad0e69f01ee1b6c187647f2a1d032b529f64428656837a384c",
  "url": "https://osv.dev/vulnerability/CVE-2025-5301",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)",
    "summary": "ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.",
    "evidence": "osv:CVE-2025-5301",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2025-5301",
      "aliases": [
        "CVE-2025-5301"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/onlyoffice/documentserver",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "b6353d8a9251f58d8cee199eb289ed8777046ed0"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "8.3.1"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v8.3.1",
            "v8.3.0",
            "v8.2.2",
            "v8.2.1",
            "v8.2.0",
            "v8.1.3",
            "v8.1.1",
            "v8.1.0",
            "v8.0.1",
            "v8.0.0",
            "v7.5.1",
            "v7.5.0",
            "v7.4.1",
            "v7.4.0",
            "v7.3.3",
            "v7.3.2",
            "v7.3.0",
            "v7.2.2",
            "v7.2.1",
            "v7.2.0",
            "v7.1.1",
            "v7.1.0",
            "v7.0.1",
            "v7.0.0",
            "v6.4.2",
            "v6.4.1",
            "v6.4.0",
            "v6.3.2",
            "v6.3.1",
            "v6.3.0",
            "v6.2.2",
            "v6.2.1",
            "v6.2.0",
            "v6.1.1",
            "v6.1.0",
            "ONLYOFFICE-DocumentServer-6.0.2",
            "ONLYOFFICE-DocumentServer-6.0.1",
            "ONLYOFFICE-DocumentServer-6.0.0",
            "ONLYOFFICE-DocumentServer-5.6.5",
            "ONLYOFFICE-DocumentServer-5.6.4",
            "ONLYOFFICE-DocumentServer-5.6.3",
            "ONLYOFFICE-DocumentServer-5.6.2",
            "ONLYOFFICE-DocumentServer-5.6.1",
            "ONLYOFFICE-DocumentServer-5.6.0",
            "ONLYOFFICE-DocumentServer-5.5.3",
            "ONLYOFFICE-DocumentServer-5.5.1",
            "ONLYOFFICE-DocumentServer-5.5.0",
            "ONLYOFFICE-DocumentServer-5.4.2",
            "ONLYOFFICE-DocumentServer-5.4.1",
            "ONLYOFFICE-DocumentServer-5.4.0-2",
            "ONLYOFFICE-DocumentServer-5.3.4",
            "ONLYOFFICE-DocumentServer-5.3.2",
            "ONLYOFFICE-DocumentServer-5.3.1",
            "ONLYOFFICE-DocumentServer-5.3.0",
            "ONLYOFFICE-DocumentServer-5.2.8",
            "ONLYOFFICE-DocumentServer-5.2.7",
            "ONLYOFFICE-DocumentServer-5.2.6",
            "ONLYOFFICE-DocumentServer-5.2.4",
            "ONLYOFFICE-DocumentServer-5.2.3",
            "ONLYOFFICE-DocumentServer-5.2.2",
            "ONLYOFFICE-DocumentServer-5.2.0",
            "ONLYOFFICE-DocumentServer-5.1.5",
            "ONLYOFFICE-DocumentServer-5.1.4",
            "ONLYOFFICE-DocumentServer-5.1.3",
            "ONLYOFFICE-DocumentServer-5.1.2",
            "ONLYOFFICE-DocumentServer-5.1.1",
            "ONLYOFFICE-DocumentServer-5.1.0",
            "ONLYOFFICE-DocumentServer-5.0.7",
            "ONLYOFFICE-DocumentServer-5.0.6",
            "ONLYOFFICE-DocumentServer-5.0.5",
            "ONLYOFFICE-DocumentServer-5.0.4",
            "ONLYOFFICE-DocumentServer-5.0.3",
            "ONLYOFFICE-DocumentServer-4.4.3",
            "ONLYOFFICE-DocumentServer-4.4.2",
            "ONLYOFFICE-DocumentServer-4.4.1",
            "ONLYOFFICE-DocumentServer-4.3.6",
            "ONLYOFFICE-DocumentServer-4.3.5",
            "ONLYOFFICE-DocumentServer-4.3.4",
            "ONLYOFFICE-DocumentServer-4.3.3",
            "ONLYOFFICE-DocumentServer-4.3.2",
            "ONLYOFFICE-DocumentServer-4.3.1",
            "ONLYOFFICE-DocumentServer-4.3.0",
            "ONLYOFFICE-DocumentServer-4.2.11",
            "ONLYOFFICE-DocumentServer-4.2.10",
            "ONLYOFFICE-DocumentServer-4.2.9",
            "ONLYOFFICE-DocumentServer-4.0.0-9",
            "ONLYOFFICE-DocumentServer-4.2.8",
            "ONLYOFFICE-DocumentServer-4.2.7",
            "ONLYOFFICE-DocumentServer-4.2.5",
            "ONLYOFFICE-DocumentServer-4.2.4",
            "ONLYOFFICE-DocumentServer-4.2.3",
            "ONLYOFFICE-DocumentServer-4.2.1",
            "ONLYOFFICE-DocumentServer-4.2.0",
            "ONLYOFFICE-DocumentServer-4.1.8-1",
            "ONLYOFFICE-DocumentServer-4.1.6-3",
            "ONLYOFFICE-DocumentServer-4.1.5-1",
            "ONLYOFFICE-DocumentServer-4.1.4-3",
            "ONLYOFFICE-DocumentServer-4.1.2-37",
            "ONLYOFFICE-DocumentServer-4.0.3-3",
            "ONLYOFFICE-DocumentServer-4.0.2-4",
            "ONLYOFFICE-DocumentServer-4.0.1-34",
            "ONLYOFFICE-DocumentServer-3.0.0",
            "ONLYOFFICE-Online-Editors-2.5.7",
            "ONLYOFFICE-Online-Editors-2.5"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-5301.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:48.958518201Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5301.json",
        "https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#832",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-5301",
        "https://r.sec-consult.com/onlyoffice",
        "https://sec-consult.com/vulnerability-lab/advisory/reflected-cross-site-scripting-in-onlyoffice-docs-documentserver/"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-79"
        ],
        "cna_assigner": "SEC-VLab",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5301.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-5301",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 516957,
  "published_at": "2025-06-12T07:59:05.65+00:00"
}