ONLYOFFICE Document Server Path Traversal Vulnerability Allowing Arbitrary File Access

A path traversal vulnerability has been identified in ONLYOFFICE Document Server versions prior to 8.0.1. This vulnerability allows remote attackers to copy arbitrary files by manipulating the fileExt parameter in the /example/editor endpoint. Exploitation of this issue could lead to unauthorized access to sensitive files and potentially cause a denial-of-service condition.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive files, with the possibility of causing a denial-of-service condition.