Critical severity9.8NVD Advisory· Published Aug 14, 2023· Updated Jul 9, 2026
CVE-2023-30186
CVE-2023-30186
Description
A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
34.0.3 - 7.3.2+ 2 more
- (no CPE)range: 4.0.3 - 7.3.2
- cpe:2.3:a:onlyoffice:document_server:*:*:*:*:*:*:*:*range: >=4.0.3,<=7.3.2
- (no CPE)
Patches
Vulnerability mechanics
References
4- github.com/ONLYOFFICE/core/commit/2b6ad83b36afd9845085b536969d366d1d61150anvdPatchVendor Advisory
- gist.github.com/merrychap/25eba8c4dd97c9e545edad1b8f0eadc2nvdExploitPatchThird Party Advisory
- github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctrenderer/nvdProduct
- github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctrenderer/embed/NativeControlEmbed.cppnvdNot Applicable
News mentions
0No linked articles in our index yet.