CVE-2026-84282 Details
Description
A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated administrator can manipulate the document server parameter to cause the ownCloud server to send arbitrary requests to attacker-controlled destinations, including localhost and internal network hosts. This allows internal network reconnaissance and TCP port scanning based on differences in server responses.
A Server-Side Request Forgery (SSRF) vulnerability has been identified in the ONLYOFFICE ownCloud Integration plugin, specifically in version 9.12. The vulnerability arises because the plugin's backend endpoint does not properly validate the user-supplied Document Server URL before making outbound connections. This flaw allows an authenticated administrator to manipulate the URL parameter, causing the ownCloud server to send requests to arbitrary, attacker-controlled destinations, including localhost and internal network hosts. Such exploitation could facilitate internal network reconnaissance and TCP port scanning based on variations in server response.
As an official patch is not currently available, it is recommended to disable or remove the ONLYOFFICE ownCloud Integration plugin until a patched version is released. Additionally, network-level egress controls should be implemented to restrict outbound connections from the ownCloud server to authorized destinations only.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 8, 2026CISA-ADP
Assessed Sep 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.kb.cert.org/vuls/id/943094 | CVE | AdvisoryRemedy |
| https://github.com/ONLYOFFICE/onlyoffice-owncloud/blob/master/controller/settingsapicontroller.php | [email protected] | Source CodeVendor |
| https://kb.cert.org/vuls/id/943094 | [email protected] | AdvisoryRemedy |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| Ascensio System SIA ONLYOFFICE ownCloud Integration | 9.12 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 10, 2026 | CVE Modified | CISA-ADP |
| Sep 8, 2026 | CVE Modified | CVE |
| Sep 8, 2026 | New CVE Received | [email protected] |