CVE-2023-25266

CVE-2023-25266 is a high-severity vulnerability affecting Docmosis Tornado versions prior to 2.9.5, allowing an authenticated attacker to achieve arbitrary remote code execution (RCE). By manipulating the Office directory setting to point to a malicious remote network path, the attacker can force the application to execute a controlled soffice binary. The vulnerability carries a CVSS score of 8.8 (HIGH) due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.