Medium severity6.1NVD Advisory· Published Jun 12, 2025· Updated Apr 15, 2026

CVE-2025-5301

Description

ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

ONLYOFFICE/Documentserverllm-fuzzy
Range: <=8.3.1

Patches

Vulnerability mechanics

References

seclists.org/fulldisclosure/2025/Jun/18nvd
github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.mdnvd
r.sec-consult.com/onlyofficenvd
sec-consult.com/vulnerability-lab/advisory/reflected-cross-site-scripting-in-onlyoffice-docs-documentserver/nvd

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.028
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000