CVE-2026-107781 Details
Description
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server fetch internal URLs and overwrite any user's stored file, then read results via queryFileToShowById.
A server-side request forgery (SSRF) vulnerability with missing authorization has been identified in Dromara Skyeye, specifically in the OnlyOffice save callback function 'editUploadOfficeFileById'. This vulnerability allows unauthenticated attackers to send arbitrary URLs and key parameters, enabling the server to fetch internal URLs, overwrite any user's stored file, and subsequently read the results through the 'queryFileToShowById' function.
It is recommended to implement authorization checks to ensure that only authenticated users can access the 'editUploadOfficeFileById' function. Additionally, validate and sanitize the 'url' parameter to prevent SSRF attacks, and restrict file overwriting capabilities to authorized users only.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Dromara Skyeye | <= 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |