CVE-2021-3199

Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.

• CWE-22

• https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563Release Notes, Third Party Advisory
• https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.pyExploit, Third Party Advisory
• https://github.com/nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.pyExploit, Third Party Advisory
• https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563Release Notes, Third Party Advisory
• https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.pyExploit, Third Party Advisory
• https://github.com/nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.pyExploit, Third Party Advisory

Published

Jan 26, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-31984Power BI Remote Code Execution Vulnerability7.6
• CVE-2021-31985Microsoft Defender Remote Code Execution Vulnerability7.8
• CVE-2021-31986User controlled parameters related to SMTP notifications are…6.8
• CVE-2021-31987A user controlled parameter related to SMTP test functionali…7.5
• CVE-2021-31988A user controlled parameter related to SMTP test functionali…8.8
• CVE-2021-31989A user with permission to log on to the machine hosting the …5.3
• CVE-2021-31996An issue was discovered in the algorithmica crate through 20…7.5
• CVE-2021-31997A UNIX Symbolic Link (Symlink) Following vulnerability in py…7.8
• CVE-2021-31998A Incorrect Default Permissions vulnerability in the packagi…7.8
• CVE-2021-31999A Reliance on Untrusted Inputs in a Security Decision vulner…8.8
• CVE-2021-3200Buffer overflow vulnerability in libsolv 2020-12-13 via the …3.3
• CVE-2021-32000A UNIX Symbolic Link (Symlink) Following vulnerability in th…7.1