Originally published at: ONLYOFFICE 10.0: A closer look at the latest 40 security fixes | ONLYOFFICE Blog
Security is part of every ONLYOFFICE release. When a vulnerability is reported, our team works to fix it quickly so your documents, your users, and your infrastructure stay protected.
ONLYOFFICE 10.0 includes more than 40 security fixes for both the online editors and the desktop app. They cover document conversion, PDF handling, macros, integrations, and server configuration. For organizations that rely on ONLYOFFICE for sensitive work, this release adds another layer of protection.
Here is what changed.
Fix in detail: XSS vulnerability in the AI() function
One of the fixes in this release addresses an XSS vulnerability in the Value field of the AI() function. Exploiting it could cause the editor to stop working.
What is XSS? Cross-site scripting (XSS) is an attack where someone injects a malicious script into content that other users then open. When the script runs, it can disrupt the application, change what the user sees, or try to access data it should never reach.
Why this fix matters:
- It keeps the editor available. A crafted value can no longer crash the editor, so your teams can keep working.
- It protects AI-powered workflows. AI features now handle more of the content people work with every day, so the inputs they accept need to be safe.
- It reduces risk across shared documents. In collaborative environments, one malicious file can reach many users. Closing this gap protects everyone who opens the document.
Security fixes for the online editors
ONLYOFFICE 10.0 resolves the following vulnerabilities in the online editors:
- Fixed XSS vulnerability in hyperlinks in DOCX documents
- Fixed macro sandbox bypass
- Fixed incorrect memory write when converting XLS to XLSX
- Fixed XSS vulnerability in the Name field when creating an AI assistant
- Fixed authorization bypass when printing PDF
- Fixed converter crash when processing circular style inheritance chains in DOCX
- Fixed stack buffer overflow when reading OLE data during conversion of legacy format documents
- Fixed heap buffer overflow when rendering image masks in PDF
- Fixed macro sandbox bypass with access to cookies
- Fixed access to OS files via the native.GetFileBinary method of the Document Builder API
- Fixed the possibility of using an editor token to access Document Builder
- Fixed SSRF vulnerability in the /ai-proxy endpoint
- Fixed out-of-bounds read when converting DOC to DOCX
- Fixed out-of-bounds read when processing PPT metafiles, which led to memory disclosure in the resulting PPTX
- Fixed out-of-bounds read when parsing character formatting in DOC files
- Fixed out-of-bounds read when parsing the piece table in DOC files
- Fixed execution of embedded JavaScript in PDF documents
- Fixed SSRF vulnerability in WOPI endpoints
- Fixed double free when converting certain DOCX files
- Fixed out-of-bounds read when parsing the font table in DOC files
- Fixed heap out-of-bounds write caused by integer overflow during document conversion
- Fixed XSS vulnerability in the function arguments window in the Spreadsheet Editor
- Fixed execution of malicious JavaScript added to PDF file actions
- Fixed path traversal vulnerability when processing HML files
- Fixed arbitrary file write when extracting archives during conversion
- Fixed local file read during EPUB conversion
- Fixed the possibility of creating the runtime.json file via a Document Builder request
- Fixed XSS vulnerability in the Document Editor via a font or style name in the Review panel
- Fixed reflected XSS vulnerability on the /baseurl page
- Fixed issuing a token for an anonymous WOPI convert-and-edit request that was accepted by the Document Builder API
- Fixed out-of-bounds read when converting XLS to XLSX
- Fixed the possibility of specifying an arbitrary file system path in logging settings via runtime.json
- Fixed co-editing session hijacking when working via WOPI
- Fixed path traversal vulnerability in the template handler for creating new files via WOPI, which led to server configuration disclosure
- Fixed vulnerabilities in the DocumentServer Docker image
- Fixed stack buffer overflow when processing fonts in XPS files
- Fixed XSS vulnerability in the HTML plugin when pasting into a document
- Fixed authentication of tenants without a configured secret in multitenant mode
- Fixed out-of-bounds read when processing EMF+ bitmaps, which led to memory disclosure
- Fixed out-of-bounds read when processing hyperlinks in XLS, which led to memory disclosure
- Fixed out-of-bounds read when rendering WMF, which led to memory disclosure in the resulting document
- Fixed privilege escalation via the documentserver-flush-cache script
- Fixed CVE-2022-3602 and CVE-2022-3786 vulnerabilities in OpenSSL in the Docker image
- Fixed CVE-2022-23308 vulnerability during document conversion
Check out the full list of security fixes for the desktop editors here.
Stay protected: update to ONLYOFFICE 10.0
The simplest way to benefit from all of these fixes is to keep your installation up to date:
- Check your current version. This matters most for self-hosted and on-premises deployments.
- Review the changelog. Confirm which fixes apply to your setup, such as Docker, WOPI integrations, or multitenant mode.
- Upgrade to version 10.0. Use the installation packages from the official ONLYOFFICE website or visit Help Center.
- Update desktop apps across your organization. This keeps every endpoint equally protected.
FAQ
Do these fixes apply to both the online and desktop editors?
Most fixes apply to both. A small number are specific to one or the other, for example, some WOPI and JWT-related fixes only apply to the online editors, while certain CEF-specific issues only affect the desktop apps.
Do I need to update if I’m using ONLYOFFICE on-premises?
Yes. On-premises and self-hosted installations do not update automatically. We strongly recommend doing this as soon as possible to benefit from all the security fixes in version 10.0.
What is a macro sandbox bypass, and why does it matter?
ONLYOFFICE runs macros in an isolated environment (a “sandbox”) to prevent them from accessing things they shouldn’t. A sandbox bypass means a macro could escape that restriction. This release closes two such bypasses, including one that allowed access to browser cookies. These fixes protect users who run macros in shared or sensitive documents.
Are PDF files now safer to open in ONLYOFFICE 10.0?
Yes. Several PDF-related vulnerabilities were fixed, including the execution of embedded JavaScript, malicious JavaScript in file actions, authorization bypass when printing, and arbitrary file deletion from PDF documents. PDFs are a common vector for malicious content, so these fixes are especially important for organizations that process documents from external sources.
How does ONLYOFFICE handle vulnerability reports?
We take every report seriously. When a vulnerability is identified – whether through internal testing, community reports, or security researchers – our team works quickly to develop and release a fix. We also maintain a public changelog so users can see exactly what was addressed in each version.
Where can I report a security vulnerability?
If you discover a security issue in ONLYOFFICE, please report it responsibly through our official security contact security@onlyoffice.com. You are also welcome to visit our Security – Contact Us page. We review all reports and will work with you to address the issue as quickly as possible.
Has the vulnerability recently reported in the press (CVE-2021-3199) been fixed in ONLYOFFICE?
Yes. The vulnerability mentioned in recent media reports (CVE-2021-3199) was fixed in version 5.6.3 of the ONLYOFFICE editors, so it does not affect current versions. We strongly recommend that anyone still running an older version update to ONLYOFFICE 10.0, which also includes all the security fixes listed above.
Useful links
ONLYOFFICE Docs 10.0: blog / webinar
ONLYOFFICE Desktop Editors 10.0