Medium severity · published Jun 12, 2025
CVE-2025-5301
Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)
6.1
CVSS
62.4%
EPSS
No
On KEV
Description
ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)62.4% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DD
Docs (DocumentServer) · OnlyOffice
<=8.3.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-5301
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-5301
github.com
https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#832
r.sec-consult.com
https://r.sec-consult.com/onlyoffice
seclists.org
http://seclists.org/fulldisclosure/2025/Jun/18
sec-consult.com
https://sec-consult.com/vulnerability-lab/advisory/reflected-cross-site-scripting-in-onlyoffice-docs-documentserver/