CVE-2026-110652

Name of the Vulnerable Software and Affected Versions ONLYOFFICE DocumentServer versions prior to 10.0.0

Description An unauthenticated server-side request forgery (SSRF) exists in the '/downloadfile/:docid' endpoint. This occurs when JWT verification is disabled in the default configuration, allowing remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag. By submitting a crafted request body containing an internal or loopback URL, the server treats the request as a DIRECT request, skipping private-address filtering and causing the server to fetch and proxy back arbitrary private-network and cloud metadata content.

Recommendations Update ONLYOFFICE DocumentServer to version 10.0.0 or later. Enable JWT verification to prevent the exploitation of the isInJwtToken flag.