CVE-2025-5301

MEDIUMNuclei

Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-5301 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 12, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Docs (DocumentServer)

Browse OnlyOffice / Docs (DocumentServer)

Default status: unaffected

CVE List<=8.3.1affected

Nuclei templates

1
ProjectDiscoveryMEDIUMONLYOFFICE Docs (DocumentServer) - Reflected Cross-Site ScriptingCVSS 6.1

ONLYOFFICE Docs (DocumentServer) <= 8.3.1 contains a reflected XSS caused by improper sanitization of crafted HTTP POST requests via the WOPI protocol, letting attackers inject malicious scripts reflected in HTML response, exploit requires crafted POST requests.

Impact

Attackers can execute malicious scripts in users' browsers, potentially stealing session data or performing actions on behalf of users.

Remediation

Update to a version later than 8.3.1.

WeaknessesCWE-79
Authorstheamanrawat
Template tagscvecve2025onlyofficexssvulnseclists
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
https://github.com/ONLYOFFICE/ https://seclists.org/fulldisclosure/2025/Jun/18 https://nvd.nist.gov/vuln/detail/CVE-2025-5301 https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#832 https://r.sec-consult.com/onlyoffice

Source: ProjectDiscovery

References

5