CVE-2025-10254 in OnlyOffice
Summary
by MITRE • 09/11/2025
A vulnerability was found in Ascensio System SIA OnlyOffice up to 12.7.0. This issue affects some unknown processing of the file /Products/Projects/Messages.aspx of the component SVG Image Handler. Performing manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was informed early about this issue and replied: "We are already working on this case, and the issues will be resolved in one of the upcoming patches."
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2025
This vulnerability resides within the Ascensio System SIA OnlyOffice platform version 12.7.0 or earlier, specifically targeting the SVG Image Handler component located at /Products/Projects/Messages.aspx. The flaw represents a classic cross site scripting vulnerability that allows remote attackers to inject malicious scripts into web pages viewed by other users. The vulnerability manifests during the processing of SVG image files through the web interface, creating an attack surface where user input is not properly sanitized before being rendered in the browser context. This particular component handles SVG image rendering within the projects messaging functionality, making it a critical point of entry for malicious actors seeking to exploit the system.
The technical nature of this vulnerability aligns with CWE-79 which describes cross site scripting flaws where untrusted data is incorporated into web pages without proper validation or encoding. The attack vector is remote and exploitation has been demonstrated in the wild, indicating that threat actors have already developed working payloads against this weakness. The vulnerability occurs because the SVG Image Handler component fails to adequately sanitize user-supplied input during file processing, allowing malicious script code to be embedded within SVG files and subsequently executed when the image is rendered in the browser. This creates a persistent threat where any user who views an infected SVG file through the affected Messages.aspx page becomes a potential victim of the XSS attack.
The operational impact of this vulnerability extends beyond simple script injection as it can enable attackers to perform various malicious activities including session hijacking, credential theft, redirection to malicious sites, and data exfiltration from authenticated users. In the context of OnlyOffice's collaborative environment, where users share projects and messages, this vulnerability could allow an attacker to compromise user sessions and potentially gain access to sensitive documents and communications within the platform. The fact that the vendor acknowledged the issue and is working on a patch indicates the severity of the threat, though the public availability of exploit code means organizations may already be under active attack.
Organizations utilizing OnlyOffice versions up to 12.7.0 should immediately implement defensive measures including input validation for SVG file uploads, implementing proper content security policies, and monitoring for suspicious file uploads. The recommended mitigation strategy involves applying the vendor's upcoming patch as soon as it becomes available, while also considering temporary workarounds such as restricting SVG file upload capabilities or implementing web application firewalls to filter malicious payloads. This vulnerability demonstrates the critical importance of validating and sanitizing all user input in web applications, particularly in collaborative platforms where users may upload various file types. The ATT&CK framework would categorize this under T1059.008 for Scripting and T1566.002 for Spearphishing Attachment, highlighting the need for comprehensive defensive measures across multiple attack vectors.