CVE-2023-46988

Path Traversal vulnerability in ONLYOFFICE Document Server before v8.0.1 allows a remote attacker to copy arbitrary files by manipulating the fileExt parameter in the /example/editor endpoint, leading to unauthorized access to sensitive files and potential Denial of Service (DoS).

CVSS v3.1

6.7 MEDIUMCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

0.52% chance of exploitation in the next 30 days, 42th percentile

Published

2025-04-01

Updated

2025-04-15

Proof-of-concept exploits (2)

• https://medium.com/@mihat2/onlyoffice-document-server-path-traversal-fdd573fec291
• mihat2/OnlyOffice-path-traversal0★ · 2025-04-01

References

• CVE Record
• NVD entry

Related

• CVE-2026-27912
• CVE-2023-46987
• CVE-2023-46992
• CVE-2023-46980
• CVE-2023-46993
• CVE-2023-4698