CVE-2026-110385 in Document Server
Summary
by MITRE • 10/15/2026
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled converter XML supplied through the optional third argument of builder.SaveFile(). By injecting a duplicate m_sFileTo element, an attacker can override the server-generated output path and write arbitrary content outside the designated job directory. This allows the attacker to overwrite the runtime.json configuration file, modify the Document Builder executable path and arguments, and execute arbitrary commands when a subsequent Document Builder job is processed.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in ONLYOFFICE Document Server prior to version 10.0.0 represents a critical remote code execution flaw rooted in improper input validation within the Document Builder API. This security defect specifically affects systems where authentication is enforced via JSON Web Tokens compatible with an Inbox service, allowing authenticated attackers to exploit the mechanism through carefully crafted XML payloads. The core technical failure lies in how the server processes user-controlled converter XML provided as the optional third argument of the builder.SaveFile() method. Instead of strictly validating or sanitizing file paths and structural elements within this XML input, the application fails to prevent duplicate entries for critical configuration fields, specifically the m_sFileTo element which dictates the destination path for saved files.
By injecting a duplicate m_sFileTo element into the converter XML, an attacker can manipulate the internal logic of the Document Builder service to override the server-generated output path. This manipulation allows the writing of arbitrary content outside the designated job directory, effectively bypassing standard sandboxing or isolation boundaries that are typically enforced for user uploads and processing tasks. The ability to write files in unrestricted locations is particularly dangerous because it enables an attacker to target sensitive configuration files managed by the ds service account, which runs with elevated privileges relative to typical application users but lower than root.
The operational impact of this vulnerability escalates significantly when the attacker targets specific runtime configuration files such as runtime.json. By overwriting or modifying this file, an adversary can alter the Document Builder executable path and its associated command-line arguments. When a subsequent Document Builder job is processed by the server, it utilizes these tampered configurations to launch external processes. Consequently, this chain of exploitation leads directly to arbitrary operating system command execution under the context of the ds service account. This level of access allows for complete compromise of the underlying host system, including potential lateral movement within the network and exfiltration of sensitive data stored on the server.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) and CWE-78 OS Command Injection. The root cause is categorized under CWE-20 Improper Input Validation, as the application fails to adequately sanitize or validate user-supplied XML structures before processing them for file operations. In terms of tactical mapping within the MITRE ATT&CK framework, this exploit leverages techniques associated with T1505 Server Software Component: Web Shell and potentially T1059 Command and Scripting Interpreter if direct script execution is facilitated through the modified arguments. The attack vector requires authentication, placing it in the category of authenticated remote attacks rather than unauthenticated exploitation.
Mitigation strategies must prioritize immediate patching to version 10.0.0 or later where these input validation checks have been hardened. In environments where upgrading is not immediately feasible, administrators should implement strict network segmentation to limit access to ONLYOFFICE services and enforce rigorous authentication policies using strong JWT signing algorithms with short expiration times. Additionally, deploying web application firewalls configured to detect anomalous XML structures or duplicate elements in API requests may provide a layer of defense against exploitation attempts. Running the ds service account with minimal necessary privileges can also help contain the blast radius should an attacker succeed in exploiting this vulnerability, although patching remains the only definitive remediation for this code execution flaw.