High severity · published Oct 8, 2026
CVE-2026-107781
Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById
7.4
CVSS
0.3%
EPSS
No
On KEV
Description
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server fetch internal URLs and overwrite any user's stored file, then read results via queryFileToShowById.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SK
skyeye · dromara
through 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107781
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107781
issue-tracking
https://github.com/dromara/skyeye/issues/29
technical-description
https://github.com/dromara/skyeye/blob/003549ae5615bd114ba5bb8ddf6a8e8ead97c321/skyeye-adm/adm-pro/src/main/java/com/skyeye/eve/diskcloud/service/impl/FileConsoleServiceImpl.java#L533-L556
product
https://github.com/dromara/skyeye
third-party-advisory
https://www.vulncheck.com/advisories/dromara-skyeye-unauthenticated-ssrf-and-file-overwrite-via-edituploadofficefilebyid
More from skyeye
9.8
CVE-2026-107780
Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter
9.8
CVE-2026-107779
Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE
6.5
CVE-2026-110609
Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter