CVE-2026-107781 in Skyeye
Summary
by MITRE • 10/09/2026
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server fetch internal URLs and overwrite any user's stored file, then read results via queryFileToShowById.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The identified security flaw resides within Dromara Skyeye, specifically affecting the component prior to commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321. This vulnerability manifests as a combination of server-side request forgery and missing authorization controls within the OnlyOffice integration module. The core issue is located in the editUploadOfficeFileById function, which serves as an endpoint for handling file uploads and edits through the OnlyOffice collaborative editing platform. Due to insufficient validation mechanisms, this endpoint allows unauthenticated actors to manipulate critical parameters without proper verification of user identity or session validity.
The technical nature of the vulnerability involves two distinct but related attack vectors. First, the application fails to validate the source of requests targeting the editUploadOfficeFileById function, leading to a missing authorization flaw that permits access by any party regardless of authentication status. Second, and more critically, the endpoint accepts arbitrary url parameters without sufficient sanitization or allow-listing. This oversight enables an attacker to craft malicious payloads containing internal network addresses as the target URL. When the server processes this request, it initiates outgoing HTTP connections to these specified destinations, effectively acting as a proxy for the attacker's requests.
This capability facilitates severe data exfiltration and integrity compromise scenarios. By directing the server to fetch URLs from within the organization's private network or internal services that are not exposed to the public internet, an unauthenticated attacker can bypass perimeter security controls such as firewalls and web application firewalls. The vulnerability allows for reading sensitive information returned by these internal endpoints through the queryFileToShowById function, which displays file contents based on provided identifiers. This mechanism effectively turns the vulnerable server into a pivot point for scanning or accessing restricted resources within the local infrastructure.
Furthermore, the ability to supply arbitrary key parameters in conjunction with the forged requests allows attackers to overwrite stored files belonging to legitimate users. By controlling both the destination of the fetch operation and the identifier used to save the result, an attacker can manipulate document content on behalf of other users or corrupt critical data assets. This represents a significant risk to data integrity and confidentiality, as it undermines trust in the file storage system and potentially allows for further exploitation chains such as code injection if executable files are targeted.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), which describes flaws where an application retrieves a remote resource without validating the user-supplied URL. Additionally, it falls under CWE-287 Improper Authentication, as the system fails to verify that the requester has appropriate privileges before executing sensitive operations involving file modification and retrieval. In terms of offensive security frameworks, this behavior maps to ATT&CK technique T1598 Phishing for Information within a Network, specifically using compromised or vulnerable systems to probe internal networks, although in this case the initial access is achieved via unauthenticated web exploitation rather than phishing.
To mitigate these risks, immediate remediation should focus on implementing strict input validation and authorization checks at the application layer. The editUploadOfficeFileById endpoint must enforce authentication requirements so that only verified users can initiate file operations. Furthermore, any URL parameters passed to server-side fetch functions must be validated against a whitelist of allowed domains or IP ranges to prevent access to internal resources. Implementing network-level controls such as egress filtering can also reduce the impact by blocking outbound connections from application servers to private address spaces unless explicitly required for business logic. Regular security audits and code reviews focusing on external-facing endpoints are recommended to identify similar patterns in other modules of the Dromara Skyeye platform.