CVE-2025-5301

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-5301
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-5301.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-5301
Published
2025-06-12T07:59:05Z
Modified
2026-08-12T03:51:14Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)
Details

ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.

Database specific 
{
    "cna_assigner": "SEC-VLab",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5301.json"
}
References

Affected packages

Git / github.com/onlyoffice/documentserver

Affected ranges

Type
GIT
Repo
https://github.com/onlyoffice/documentserver
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
b6353d8a9251f58d8cee199eb289ed8777046ed0
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.3.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

ONLYOFFICE-DocumentServer-3.*
ONLYOFFICE-DocumentServer-3.0.0
ONLYOFFICE-DocumentServer-4.*
ONLYOFFICE-DocumentServer-4.0.0-9
ONLYOFFICE-DocumentServer-4.0.1-34
ONLYOFFICE-DocumentServer-4.0.2-4
ONLYOFFICE-DocumentServer-4.0.3-3
ONLYOFFICE-DocumentServer-4.1.2-37
ONLYOFFICE-DocumentServer-4.1.4-3
ONLYOFFICE-DocumentServer-4.1.5-1
ONLYOFFICE-DocumentServer-4.1.6-3
ONLYOFFICE-DocumentServer-4.1.8-1
ONLYOFFICE-DocumentServer-4.2.0
ONLYOFFICE-DocumentServer-4.2.1
ONLYOFFICE-DocumentServer-4.2.10
ONLYOFFICE-DocumentServer-4.2.11
ONLYOFFICE-DocumentServer-4.2.3
ONLYOFFICE-DocumentServer-4.2.4
ONLYOFFICE-DocumentServer-4.2.5
ONLYOFFICE-DocumentServer-4.2.7
ONLYOFFICE-DocumentServer-4.2.8
ONLYOFFICE-DocumentServer-4.2.9
ONLYOFFICE-DocumentServer-4.3.0
ONLYOFFICE-DocumentServer-4.3.1
ONLYOFFICE-DocumentServer-4.3.2
ONLYOFFICE-DocumentServer-4.3.3
ONLYOFFICE-DocumentServer-4.3.4
ONLYOFFICE-DocumentServer-4.3.5
ONLYOFFICE-DocumentServer-4.3.6
ONLYOFFICE-DocumentServer-4.4.1
ONLYOFFICE-DocumentServer-4.4.2
ONLYOFFICE-DocumentServer-4.4.3
ONLYOFFICE-DocumentServer-5.*
ONLYOFFICE-DocumentServer-5.0.3
ONLYOFFICE-DocumentServer-5.0.4
ONLYOFFICE-DocumentServer-5.0.5
ONLYOFFICE-DocumentServer-5.0.6
ONLYOFFICE-DocumentServer-5.0.7
ONLYOFFICE-DocumentServer-5.1.0
ONLYOFFICE-DocumentServer-5.1.1
ONLYOFFICE-DocumentServer-5.1.2
ONLYOFFICE-DocumentServer-5.1.3
ONLYOFFICE-DocumentServer-5.1.4
ONLYOFFICE-DocumentServer-5.1.5
ONLYOFFICE-DocumentServer-5.2.0
ONLYOFFICE-DocumentServer-5.2.2
ONLYOFFICE-DocumentServer-5.2.3
ONLYOFFICE-DocumentServer-5.2.4
ONLYOFFICE-DocumentServer-5.2.6
ONLYOFFICE-DocumentServer-5.2.7
ONLYOFFICE-DocumentServer-5.2.8
ONLYOFFICE-DocumentServer-5.3.0
ONLYOFFICE-DocumentServer-5.3.1
ONLYOFFICE-DocumentServer-5.3.2
ONLYOFFICE-DocumentServer-5.3.4
ONLYOFFICE-DocumentServer-5.4.0-2
ONLYOFFICE-DocumentServer-5.4.1
ONLYOFFICE-DocumentServer-5.4.2
ONLYOFFICE-DocumentServer-5.5.0
ONLYOFFICE-DocumentServer-5.5.1
ONLYOFFICE-DocumentServer-5.5.3
ONLYOFFICE-DocumentServer-5.6.0
ONLYOFFICE-DocumentServer-5.6.1
ONLYOFFICE-DocumentServer-5.6.2
ONLYOFFICE-DocumentServer-5.6.3
ONLYOFFICE-DocumentServer-5.6.4
ONLYOFFICE-DocumentServer-5.6.5
ONLYOFFICE-DocumentServer-6.*
ONLYOFFICE-DocumentServer-6.0.0
ONLYOFFICE-DocumentServer-6.0.1
ONLYOFFICE-DocumentServer-6.0.2
ONLYOFFICE-Online-Editors-2.*
ONLYOFFICE-Online-Editors-2.5
ONLYOFFICE-Online-Editors-2.5.7
v6.*
v6.1.0
v6.1.1
v6.2.0
v6.2.1
v6.2.2
v6.3.0
v6.3.1
v6.3.2
v6.4.0
v6.4.1
v6.4.2
v7.*
v7.0.0
v7.0.1
v7.1.0
v7.1.1
v7.2.0
v7.2.1
v7.2.2
v7.3.0
v7.3.2
v7.3.3
v7.4.0
v7.4.1
v7.5.0
v7.5.1
v8.*
v8.0.0
v8.0.1
v8.1.0
v8.1.1
v8.1.3
v8.2.0
v8.2.1
v8.2.2
v8.3.0
v8.3.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-5301.json"