{"id":"CVE-2026-110652","summary":"ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass","details":"ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in the default configuration. Attackers can submit a crafted request body containing an internal or loopback URL, which is treated as a DIRECT request skipping private-address filtering, causing the server to fetch and proxy back arbitrary private-network and cloud metadata content.","modified":"2026-10-17T10:45:56.914658827Z","published":"2026-10-14T13:15:00.461Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110652.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"2.5.0"},{"fixed":"10.0.0"}]},{"source":"CPE_FIELD","extracted_events":[{"introduced":"2.5.0"},{"fixed":"10.0.0"}]},{"extracted_events":[{"fixed":"10.0.0"}],"source":"DESCRIPTION"}],"cna_assigner":"VulnCheck","cwe_ids":["CWE-918"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110652.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110652"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/onlyoffice-documentserver-before-ssrf-via-downloadfile-isinjwttoken-bypass"},{"type":"REPORT","url":"https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#1000"},{"type":"FIX","url":"https://github.com/ONLYOFFICE/DocumentServer/releases/tag/v10.0.0"},{"type":"PACKAGE","url":"https://github.com/ONLYOFFICE/DocumentServer"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/onlyoffice/documentserver","events":[{"introduced":"0"},{"fixed":"16bac9f9ad54c8145a58e23446c504b5727729ac"}],"database_specific":{"source":["DESCRIPTION","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"10.0.0"}]}}],"versions":["v9.4.0","v9.3.1","v9.3.0","v9.2.1","v9.2.0","v9.1.0","v9.0.4","v9.0.3","v9.0.2","v9.0.0","v8.3.3","v8.3.2","v8.3.1","v8.3.0","v8.2.2","v8.2.1","v8.2.0","v8.1.3","v8.1.1","v8.1.0","v8.0.1","v8.0.0","v7.5.1","v7.5.0","v7.4.1","v7.4.0","v7.3.3","v7.3.2","v7.3.0","v7.2.2","v7.2.1","v7.2.0","v7.1.1","v7.1.0","v7.0.1","v7.0.0","v6.4.2","v6.4.1","v6.4.0","v6.3.2","v6.3.1","v6.3.0","v6.2.2","v6.2.1","v6.2.0","v6.1.1","v6.1.0","ONLYOFFICE-DocumentServer-6.0.2","ONLYOFFICE-DocumentServer-6.0.1","ONLYOFFICE-DocumentServer-6.0.0","ONLYOFFICE-DocumentServer-5.6.5","ONLYOFFICE-DocumentServer-5.6.4","ONLYOFFICE-DocumentServer-5.6.3","ONLYOFFICE-DocumentServer-5.6.2","ONLYOFFICE-DocumentServer-5.6.1","ONLYOFFICE-DocumentServer-5.6.0","ONLYOFFICE-DocumentServer-5.5.3","ONLYOFFICE-DocumentServer-5.5.1","ONLYOFFICE-DocumentServer-5.5.0","ONLYOFFICE-DocumentServer-5.4.2","ONLYOFFICE-DocumentServer-5.4.1","ONLYOFFICE-DocumentServer-5.4.0-2","ONLYOFFICE-DocumentServer-5.3.4","ONLYOFFICE-DocumentServer-5.3.2","ONLYOFFICE-DocumentServer-5.3.1","ONLYOFFICE-DocumentServer-5.3.0","ONLYOFFICE-DocumentServer-5.2.8","ONLYOFFICE-DocumentServer-5.2.7","ONLYOFFICE-DocumentServer-5.2.6","ONLYOFFICE-DocumentServer-5.2.4","ONLYOFFICE-DocumentServer-5.2.3","ONLYOFFICE-DocumentServer-5.2.2","ONLYOFFICE-DocumentServer-5.2.0","ONLYOFFICE-DocumentServer-5.1.5","ONLYOFFICE-DocumentServer-5.1.4","ONLYOFFICE-DocumentServer-5.1.3","ONLYOFFICE-DocumentServer-5.1.2","ONLYOFFICE-DocumentServer-5.1.1","ONLYOFFICE-DocumentServer-5.1.0","ONLYOFFICE-DocumentServer-5.0.7","ONLYOFFICE-DocumentServer-5.0.6","ONLYOFFICE-DocumentServer-5.0.5","ONLYOFFICE-DocumentServer-5.0.4","ONLYOFFICE-DocumentServer-5.0.3","ONLYOFFICE-DocumentServer-4.4.3","ONLYOFFICE-DocumentServer-4.4.2","ONLYOFFICE-DocumentServer-4.4.1","ONLYOFFICE-DocumentServer-4.3.6","ONLYOFFICE-DocumentServer-4.3.5","ONLYOFFICE-DocumentServer-4.3.4","ONLYOFFICE-DocumentServer-4.3.3","ONLYOFFICE-DocumentServer-4.3.2","ONLYOFFICE-DocumentServer-4.3.1","ONLYOFFICE-DocumentServer-4.3.0","ONLYOFFICE-DocumentServer-4.2.11","ONLYOFFICE-DocumentServer-4.2.10","ONLYOFFICE-DocumentServer-4.2.9","ONLYOFFICE-DocumentServer-4.0.0-9","ONLYOFFICE-DocumentServer-4.2.8","ONLYOFFICE-DocumentServer-4.2.7","ONLYOFFICE-DocumentServer-4.2.5","ONLYOFFICE-DocumentServer-4.2.4","ONLYOFFICE-DocumentServer-4.2.3","ONLYOFFICE-DocumentServer-4.2.1","ONLYOFFICE-DocumentServer-4.2.0","ONLYOFFICE-DocumentServer-4.1.8-1","ONLYOFFICE-DocumentServer-4.1.6-3","ONLYOFFICE-DocumentServer-4.1.5-1","ONLYOFFICE-DocumentServer-4.1.4-3","ONLYOFFICE-DocumentServer-4.1.2-37","ONLYOFFICE-DocumentServer-4.0.3-3","ONLYOFFICE-DocumentServer-4.0.2-4","ONLYOFFICE-DocumentServer-4.0.1-34","ONLYOFFICE-DocumentServer-3.0.0","ONLYOFFICE-Online-Editors-2.5.7","ONLYOFFICE-Online-Editors-2.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110652.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N"}]}