CVE-2025-5301

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-5301

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-5301.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-5301

Published

2025-06-12T07:59:05Z

Modified

2026-10-28T02:30:48Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)

Details

ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.

Database specific

{
    "cna_assigner":  "SEC-VLab",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5301.json"
}

References

Affected packages

Git / github.com/onlyoffice/documentserver

Affected ranges

Type

GIT

Repo

https://github.com/onlyoffice/documentserver

Events

Introduced

Last Affected

b6353d8a9251f58d8cee199eb289ed8777046ed0

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "8.3.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        }
    ]
}

Affected versions

ONLYOFFICE-DocumentServer-3.*

ONLYOFFICE-DocumentServer-3.0.0

ONLYOFFICE-DocumentServer-4.*

ONLYOFFICE-DocumentServer-4.0.0-9

ONLYOFFICE-DocumentServer-4.0.1-34

ONLYOFFICE-DocumentServer-4.0.2-4

ONLYOFFICE-DocumentServer-4.0.3-3

ONLYOFFICE-DocumentServer-4.1.2-37

ONLYOFFICE-DocumentServer-4.1.4-3

ONLYOFFICE-DocumentServer-4.1.5-1

ONLYOFFICE-DocumentServer-4.1.6-3

ONLYOFFICE-DocumentServer-4.1.8-1

ONLYOFFICE-DocumentServer-4.2.0

ONLYOFFICE-DocumentServer-4.2.1

ONLYOFFICE-DocumentServer-4.2.10

ONLYOFFICE-DocumentServer-4.2.11

ONLYOFFICE-DocumentServer-4.2.3

ONLYOFFICE-DocumentServer-4.2.4

ONLYOFFICE-DocumentServer-4.2.5

ONLYOFFICE-DocumentServer-4.2.7

ONLYOFFICE-DocumentServer-4.2.8

ONLYOFFICE-DocumentServer-4.2.9

ONLYOFFICE-DocumentServer-4.3.0

ONLYOFFICE-DocumentServer-4.3.1

ONLYOFFICE-DocumentServer-4.3.2

ONLYOFFICE-DocumentServer-4.3.3

ONLYOFFICE-DocumentServer-4.3.4

ONLYOFFICE-DocumentServer-4.3.5

ONLYOFFICE-DocumentServer-4.3.6

ONLYOFFICE-DocumentServer-4.4.1

ONLYOFFICE-DocumentServer-4.4.2

ONLYOFFICE-DocumentServer-4.4.3

ONLYOFFICE-DocumentServer-5.*

ONLYOFFICE-DocumentServer-5.0.3

ONLYOFFICE-DocumentServer-5.0.4

ONLYOFFICE-DocumentServer-5.0.5

ONLYOFFICE-DocumentServer-5.0.6

ONLYOFFICE-DocumentServer-5.0.7

ONLYOFFICE-DocumentServer-5.1.0

ONLYOFFICE-DocumentServer-5.1.1

ONLYOFFICE-DocumentServer-5.1.2

ONLYOFFICE-DocumentServer-5.1.3

ONLYOFFICE-DocumentServer-5.1.4

ONLYOFFICE-DocumentServer-5.1.5

ONLYOFFICE-DocumentServer-5.2.0

ONLYOFFICE-DocumentServer-5.2.2

ONLYOFFICE-DocumentServer-5.2.3

ONLYOFFICE-DocumentServer-5.2.4

ONLYOFFICE-DocumentServer-5.2.6

ONLYOFFICE-DocumentServer-5.2.7

ONLYOFFICE-DocumentServer-5.2.8

ONLYOFFICE-DocumentServer-5.3.0

ONLYOFFICE-DocumentServer-5.3.1

ONLYOFFICE-DocumentServer-5.3.2

ONLYOFFICE-DocumentServer-5.3.4

ONLYOFFICE-DocumentServer-5.4.0-2

ONLYOFFICE-DocumentServer-5.4.1

ONLYOFFICE-DocumentServer-5.4.2

ONLYOFFICE-DocumentServer-5.5.0

ONLYOFFICE-DocumentServer-5.5.1

ONLYOFFICE-DocumentServer-5.5.3

ONLYOFFICE-DocumentServer-5.6.0

ONLYOFFICE-DocumentServer-5.6.1

ONLYOFFICE-DocumentServer-5.6.2

ONLYOFFICE-DocumentServer-5.6.3

ONLYOFFICE-DocumentServer-5.6.4

ONLYOFFICE-DocumentServer-5.6.5

ONLYOFFICE-DocumentServer-6.*

ONLYOFFICE-DocumentServer-6.0.0

ONLYOFFICE-DocumentServer-6.0.1

ONLYOFFICE-DocumentServer-6.0.2

ONLYOFFICE-Online-Editors-2.*

ONLYOFFICE-Online-Editors-2.5

ONLYOFFICE-Online-Editors-2.5.7

v6.*

v6.1.0

v6.1.1

v6.2.0

v6.2.1

v6.2.2

v6.3.0

v6.3.1

v6.3.2

v6.4.0

v6.4.1

v6.4.2

v7.*

v7.0.0

v7.0.1

v7.1.0

v7.1.1

v7.2.0

v7.2.1

v7.2.2

v7.3.0

v7.3.2

v7.3.3

v7.4.0

v7.4.1

v7.5.0

v7.5.1

v8.*

v8.0.0

v8.0.1

v8.1.0

v8.1.1

v8.1.3

v8.2.0

v8.2.1

v8.2.2

v8.3.0

v8.3.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-5301.json"