CVE-2025-5301

CVE-2025-5301: Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)

Vendor Onlyoffice

Product Docs (DocumentServer)

Weakness CWE-79 · XSS

Published June 12, 2025

Last update June 18, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.

Key dates

02Disclosure timeline

June 12, 2025 CVE published

June 18, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-5301 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2024-54301 WordPress FormFacade plugin <= 1.3.6 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2025-9879 Spotify Embed Creator <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-1276 Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-64847 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) CVE-2021-24157 Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Stored Cross Site Scripting