CVE-2026-84282

A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated administrator can manipulate the document server parameter to cause the ownCloud server to send arbitrary requests to attacker-controlled destinations, including localhost and internal network hosts. This allows internal network reconnaissance and TCP port scanning based on differences in server responses.

• https://github.com/ONLYOFFICE/onlyoffice-owncloud/blob/master/controller/settingsapicontroller.php
• https://kb.cert.org/vuls/id/943094
• https://www.kb.cert.org/vuls/id/943094

Published

Sep 8, 2026

Last Modified

Sep 10, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8427Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Requ…8.8
• CVE-2026-84270A flaw was found in the MTP backend in gvfs. When reading a …4.3
• CVE-2026-84279The Fancy Product Designer plugin for WordPress is vulnerabl…7.2
• CVE-2026-8428Concrete CMS 9.5.0 and below emits a CSRF token in the local…8.8
• CVE-2026-84280The Fancy Product Designer plugin for WordPress is vulnerabl…7.2
• CVE-2026-84281The Fancy Product Designer plugin for WordPress is vulnerabl…7.2
• CVE-2026-84283Secure Folder 1.2 stores files selected for its password-pro…6.8
• CVE-2026-84285An OS Command Injection vulnerability affecting Tuleap Enter…8.8
• CVE-2026-84287A flaw has been found in NousResearch hermes-agent 0.18.0. A…4.3
• CVE-2026-84288A vulnerability has been found in NousResearch hermes-agent …4.3
• CVE-2026-84289A vulnerability was found in NousResearch hermes-agent up to…4.3
• CVE-2026-8429SPIP versions prior to 4.4.14 contain a remote code executio…8.8