A newly tracked vulnerability, CVE-2026-110385, affects ONLYOFFICE Document Server builds prior to version 10.0.0, letting an authenticated attacker holding a valid JWT run arbitrary OS commands under the service's own account. The root cause lies in how the Document Builder API handles attacker-supplied XML passed to its file-saving function, which can be manipulated to redirect output to an unintended path. Administrators running affected ONLYOFFICE deployments should apply the vendor's patch promptly.
// source: nvd.nist.gov ↗