ONLYOFFICE Document Server up to 9.x Document Builder runtime.json builder.SaveFile third argument path traversal

Summaryinfo

A vulnerability described as critical has been identified in ONLYOFFICE Document Server up to 9.x. Affected by this issue is the function builder.SaveFile of the file runtime.json of the component Document Builder. Such manipulation of the argument third argument leads to path traversal. This vulnerability is uniquely identified as CVE-2026-110385. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in ONLYOFFICE Document Server up to 9.x and classified as critical. Affected by this issue is the function builder.SaveFile of the file runtime.json of the component Document Builder. The manipulation of the argument third argument with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled converter XML supplied through the optional third argument of builder.SaveFile(). By injecting a duplicate m_sFileTo element, an attacker can override the server-generated output path and write arbitrary content outside the designated job directory. This allows the attacker to overwrite the runtime.json configuration file, modify the Document Builder executable path and arguments, and execute arbitrary commands when a subsequent Document Builder job is processed.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-110385 since 10/14/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

By approaching the search of inurl:runtime.json it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 10.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• ONLYOFFICE

Name

• Document Server

Version

• 9.x

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion