CVE-2021-3199 affects ONLYOFFICE Document Server before 5.6.3. NVD describes directory traversal with remote code execution reachable in /upload when JWT is used, through a /.. sequence in an image upload parameter. The score is 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CISA added it to the Known Exploited Vulnerabilities catalog on 8 October 2026.

The detail that confuses people

The description mentions JWT, and a first reading suggests an authentication flaw. It is not. The JWT is the token that authorises the upload request, and the vulnerable code path is the one that handles the request after authorisation succeeds.
That distinction changes the threat model. The attacker does not need to break the signing mechanism. They need a valid token, which in many deployments is generated by the integrating application server and handed to the client as part of normal document editing. A user who can open a document in an embedded editor receives a token.
So the vulnerable population is not "internet-facing unauthenticated attackers". It is anyone who can obtain an upload token, which includes ordinary application users, and in misconfigured deployments it can include anyone the document server will issue a session to.

What the traversal reaches

An image upload parameter naming a path with a /.. sequence moves the destination outside the intended upload directory. The result is a file written to a location the attacker chooses, subject to the permissions of the document server process.
From there, the path to code execution is the standard one for a server that renders content: place a script or a module where the application will load it, then trigger the load. ONLYOFFICE Document Server runs as a service account, and the fixed release is 5.6.3.

Why this one keeps mattering

Document servers are embedded infrastructure. They sit behind a web application, often behind a reverse proxy, and they are rarely the component anyone thinks about during a change review. The integration was completed once and has been stable since, which in practice means the version has not moved.
A 2021 defect on a component whose version is frozen at the integration point is a durable exposure. The catalog addition in 2026 measures how many of those integrations are still running the old build.

Inventory before you patch

Enumerate every deployment of Document Server, including the container images pulled from a registry and the appliance images that bundle it. The version appears in the health endpoint of a running instance, which is more reliable than a package list on a host that runs containers.
For each instance, determine whether the integrating application issues JWT tokens and to whom. If tokens are issued to browser clients, the vulnerable endpoint is reachable by every user of the application. If tokens are issued only to a backend service, the attack surface is narrower but the backend becomes the place an attacker must first reach.
Check the reverse proxy rules. If /upload is reachable from the internet rather than only from the integrating application, the deployment has widened the surface beyond the design.

After the patch

Verify the fixed build is the one actually running, not just the one that was installed. Container registries cache, orchestration platforms pin tags, and a rollback can silently restore the vulnerable image.
Then review the document server's file system for files that no part of the deployment should have created. The traversal writes through the service account, so files owned by that account, located outside the documented working directories, and modified outside a deployment window are the artefacts to look for.

The transferable lesson

A document server is a rendering engine with a file upload endpoint and a token-based authorisation model. Each of those three properties is a normal part of a collaboration product and each is a place where input validation has to be exactly right. CVE-2021-3199 is what happens when the path validation in one handler falls behind the rest of the codebase.
Five years is long enough for a fix to reach every deployment that wanted it. The KEV addition is a statement that the population which never upgraded is still large enough to scan.

References

  • NIST NVD record for CVE-2021-3199, https://nvd.nist.gov/vuln/detail/CVE-2021-3199

  • ONLYOFFICE Document Server changelog, https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md

  • CISA Known Exploited Vulnerabilities catalog entry, https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3199