CVE-2026-93643

Name of the Vulnerable Software and Affected Versions OnlyOffice/Document Editing (affected versions not specified)

Description An unauthenticated remote attacker with access to a supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes. This allows the attacker to execute commands as the zimbra user. Path-traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.