CVE-2020-11536

Name of the Vulnerable Software and Affected Versions ONLYOFFICE Document Server version 5.5.0

Description An issue was discovered that allows an attacker to craft a malicious .docx file and exploit the unzip function. This can lead to rewriting a binary and remotely executing code on a victim's server.

Recommendations For ONLYOFFICE Document Server version 5.5.0, consider disabling the unzip function for .docx files until a patch is available. Restrict access to the server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.