Server Path Traversal Vulnerability
Exploited in the wild. CISA added it to its Known Exploited Vulnerabilities list on 8 Oct 2026.
30%
Reading the vendor advisory
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2021-3199. Nothing runs until you send it.
ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.
You are affected if
The fix