CVE-2026-107781

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-107781

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107781.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-107781

Published

2026-10-08T20:15:56Z

Modified

2026-10-10T02:47:23Z

Severity

9.1 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById

Details

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server fetch internal URLs and overwrite any user's stored file, then read results via queryFileToShowById.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107781.json"
}

References

Affected packages

Git / github.com/dromara/skyeye

Affected ranges

Type: GIT
Repo: https://github.com/dromara/skyeye
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last Affected

003549ae5615bd114ba5bb8ddf6a8e8ead97c321

Affected versions

2.*

2.0.0

Other

20220703

中小企业ERP

开源ERP系统

生产管理ERP

进销存系统

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107781.json"