Onlyoffice

Onlyoffice develops a suite of document editing and collaboration server products that integrate productivity functionality into web platforms and self-hosted deployments, positioning them across enterprise and cloud-based document workflows. Vulnerabilities affecting the vendor skew strongly toward critical-severity outcomes, with the exposure concentrating in the Document Server and core editing components and recurring through application-layer weakness classes including cross-site scripting, path traversal, out-of-bounds writes, and improper input validation. These patterns reflect the complexity of parsing multiple document formats, rendering content securely, and validating user-supplied file paths and parameters in a web-accessible context. Defenders should treat Onlyoffice advisories as high-priority where the product is exposed to untrusted document sources or internet-facing deployments, and should prioritize patching to limit the attack surface of document conversion and preview functionality. Current severity, exploitation, and exposure counts are shown alongside this summary.