CVE-2025-68917

The vulnerability is a stored cross-site scripting (XSS) issue in the comment editing form of ONLYOFFICE Docs. In versions prior to 9.2.1, user input entered into the textarea of the comment form is not properly sanitized before being stored and later rendered to other users [1]. This allows an attacker to inject malicious JavaScript code into a comment.

To exploit this, an attacker must be an authenticated user who can create or edit comments on documents. The malicious comment is stored on the server and subsequently displayed to any user viewing the document. No special network access or additional authentication is required beyond a valid account [1].

Successful exploitation enables the attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to session hijacking, theft of sensitive data, or arbitrary actions performed on behalf of the victim within the ONLYOFFICE application [1].

The vulnerability is fixed in ONLYOFFICE Docs version 9.2.1. Users are advised to upgrade immediately to mitigate the risk [1].