CVE-2026-110385: ONLYOFFICE Document Server RCE Vulnerability

CVE-2026-110385 Overview

CVE-2026-110385 is a remote code execution vulnerability in ONLYOFFICE Document Server versions before 10.0.0. The flaw resides in the Document Builder API, which improperly processes user-controlled converter XML passed through the optional third argument of builder.SaveFile(). An authenticated attacker holding a valid Inbox-compatible JSON Web Token (JWT) can inject a duplicate m_sFileTo element, override the server-generated output path, and write arbitrary content outside the designated job directory. This primitive enables overwriting the runtime.json configuration file to control the Document Builder executable path and arguments, resulting in arbitrary command execution as the ds service account. The weakness is classified under CWE-73: External Control of File Name or Path.

Critical Impact

Authenticated attackers can execute arbitrary operating system commands as the ds service account, leading to full compromise of the Document Server host.

Affected Products

• ONLYOFFICE Document Server versions prior to 10.0.0
• Document Builder API component (builder.SaveFile())
• Deployments exposing the Inbox-compatible JWT authentication surface

Discovery Timeline

• 2026-10-14 - CVE-2026-110385 published to NVD
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110385

Vulnerability Analysis

The Document Builder API accepts an optional third argument to builder.SaveFile() containing converter XML. The server fails to validate the structure of this XML before merging it with internally generated conversion parameters. When an attacker supplies a duplicate m_sFileTo element, the server-generated output path is overridden by the attacker-controlled value. This allows arbitrary file writes outside the intended per-job working directory.

The write primitive escalates to code execution by targeting runtime.json, the configuration file consumed by the Document Builder worker. By overwriting this file, the attacker modifies the executable path and command-line arguments used by subsequent conversion jobs. The next Document Builder invocation executes the attacker-supplied command as the ds service account, which owns the Document Server runtime.

Root Cause

The root cause is external control of a file path through improper handling of duplicate XML elements [CWE-73]. The API trusts user-supplied converter XML and does not enforce a server-authoritative output location. XML parsing semantics that honor the last occurrence of a repeated element allow a single injected m_sFileTo tag to override the trusted value.

Attack Vector

Exploitation requires network access to the Document Server and a valid Inbox-compatible JWT. The attacker invokes builder.SaveFile() with crafted converter XML containing a duplicate m_sFileTo element pointing at the runtime.json configuration path. After writing the malicious configuration, the attacker triggers any Document Builder job, which executes the attacker-defined binary and arguments. See the ONLYOFFICE Document Server Changelog for release notes covering the fix.

Detection Methods for CVE-2026-110385

Indicators of Compromise

• Unexpected modifications to runtime.json or other files within the Document Server installation directory outside normal upgrade windows.
• Document Builder worker processes spawning non-standard child processes such as shells, interpreters, or network utilities.
• Outbound network connections initiated by the ds service account to unfamiliar destinations.
• Document Builder job requests containing XML payloads with duplicated m_sFileTo elements or absolute paths referencing configuration files.

Detection Strategies

• Inspect application and reverse proxy logs for builder.SaveFile() calls carrying oversized or structurally anomalous third-argument XML payloads.
• Monitor file integrity on runtime.json and the Document Builder executable directory using a host integrity monitoring agent.
• Correlate JWT issuance events with subsequent Document Builder job submissions to identify abuse of long-lived or leaked tokens.

Monitoring Recommendations

• Enable verbose logging on the Document Server converter subsystem to capture the full converter XML submitted by clients.
• Alert on process creation events where the parent is a Document Builder worker and the child is a shell, scripting interpreter, or curl/wget.
• Audit file writes performed by the ds service account that target paths outside standard per-job temporary directories.

How to Mitigate CVE-2026-110385

Immediate Actions Required

• Upgrade ONLYOFFICE Document Server to version 10.0.0 or later as the primary remediation.
• Rotate all JWT signing secrets and revoke outstanding Inbox-compatible tokens to invalidate any credentials collected prior to patching.
• Restrict network reachability of the Document Server management and API endpoints to trusted hosts only.
• Review runtime.json and the Document Builder executable for unauthorized modifications before returning the system to production.

Patch Information

The vulnerability is addressed in ONLYOFFICE Document Server 10.0.0. Refer to the ONLYOFFICE Document Server Changelog for the complete list of security fixes and upgrade guidance. Operators of containerized or packaged deployments should pull the updated images and validate the running version after deployment.

Workarounds

• If immediate upgrade is not possible, place the Document Server behind an authenticated reverse proxy that strips or validates the third argument to builder.SaveFile().
• Enforce strict JWT issuance policies with short expiration windows and least-privilege scopes to limit which clients can submit builder jobs.
• Run the ds service account under a hardened systemd or container profile that denies writes to runtime.json and the Document Builder binary path.

# Verify installed Document Server version and inspect runtime configuration integrity
docker exec onlyoffice-documentserver documentserver --version
sha256sum /var/www/onlyoffice/documentserver/server/FileConverter/bin/runtime.json