CVE-2021-25830

A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13. An attacker must request the conversion of the crafted file from DOCT into DOCX format. Using the chain of two other bugs related to improper string handling, an attacker can achieve remote code execution on DocumentServer.

• https://github.com/ONLYOFFICE/DocumentServerProduct
• https://github.com/ONLYOFFICE/coreProduct
• https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L1918Third Party Advisory
• https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L241Third Party Advisory
• https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/PPTXFormat/Logic/UniFill.cpp#L343Third Party Advisory
• https://github.com/merrychap/poc_exploits/tree/master/ONLYOFFICE/CVE-2021-25830Exploit, Third Party Advisory
• https://github.com/ONLYOFFICE/DocumentServerProduct
• https://github.com/ONLYOFFICE/coreProduct
• https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L1918Third Party Advisory
• https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L241Third Party Advisory
• https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/PPTXFormat/Logic/UniFill.cpp#L343Third Party Advisory
• https://github.com/merrychap/poc_exploits/tree/master/ONLYOFFICE/CVE-2021-25830Exploit, Third Party Advisory

Published

Mar 1, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-25810Cross site Scripting (XSS) vulnerability in MERCUSYS Mercury…6.1
• CVE-2021-25811MERCUSYS Mercury X18G 1.0.5 devices allow Denial of service …7.5
• CVE-2021-25812Command injection vulnerability in China Mobile An Lianbao W…9.8
• CVE-2021-25827Emby Server < 4.7.12.0 is vulnerable to a login bypass attac…9.8
• CVE-2021-25828Emby Server versions < 4.6.0.50 is vulnerable to Cross Site …6.1
• CVE-2021-25829An improper binary stream data handling issue was found in t…7.5
• CVE-2021-25831A file extension handling issue was found in [core] module o…9.8
• CVE-2021-25832A heap buffer overflow vulnerability inside of BMP image pro…9.8
• CVE-2021-25833A file extension handling issue was found in [server] module…9.8
• CVE-2021-25834Cosmos Network Ethermint <= v0.4.0 is affected by a transact…7.5
• CVE-2021-25835Cosmos Network Ethermint <= v0.4.0 is affected by a cross-ch…7.5
• CVE-2021-25836Cosmos Network Ethermint <= v0.4.0 is affected by cache life…7.5