CVE-2025-5301: Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 62.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-06-12 · updated 2026-06-17
Weakness: CWE-79

Description

ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.

Affected products

OnlyOffice Docs (DocumentServer): through 8.3.1

References

https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#832
https://r.sec-consult.com/onlyoffice
http://seclists.org/fulldisclosure/2025/Jun/18
https://sec-consult.com/vulnerability-lab/advisory/reflected-cross-site-scripting-in-onlyoffice-docs-documentserver/

Get alerted when CVE-2025-5301 or the next vulnerability affects your stack