CVE-2025-5301

What it actually does

Reflected cross-site scripting flaw allows an attacker to supply a malicious script payload inside a crafted HTTP POST request to the WOPI endpoint; the server echoes the payload verbatim inside its HTML response, causing the victim's browser to execute the script in the context of the ONLYOFFICE origin.

Why it matters to the business

Attackers can steal session tokens, exfiltrate document contents, or perform actions on behalf of an authenticated user who opens a malicious link, resulting in data leakage and loss of trust in the document collaboration platform.

How an attack unfolds

An attacker prepares a crafted WOPI POST request containing a script payload, hosts or sends a link that triggers the request, and waits for a victim to open the document; upon reflection the script executes, enabling theft of cookies or redirection to attacker-controlled sites. The rising EPSS score and weaponized exploit maturity indicate public tooling is already available for this vector.

How to fix it

Upgrade ONLYOFFICE Docs to a version newer than 8.3.1 that contains the WOPI input sanitization fix. If an immediate upgrade is not possible, enforce strict Content-Security-Policy headers that block inline scripts and restrict script sources to trusted origins only.

How to confirm the fix worked

Confirm the installed version exceeds 8.3.1, re-issue a test WOPI POST containing a benign script payload and verify the payload is no longer present in the HTML response, and run automated XSS scanners against the WOPI endpoints.

Typical attack path

1. Identify a WOPI integration endpoint accepting file-open POST requests
2. Craft a POST body that injects a script tag or event handler in a reflected parameter
3. Host or deliver a link that causes the victim browser to submit the malicious POST
4. Victim opens the document link, script executes in the ONLYOFFICE origin context
5. Script performs session theft, content exfiltration, or further actions

How to detect it

Inspect web-server access logs for POST requests to WOPI-related paths that contain HTML tags, JavaScript keywords, or unusually long parameter values; correlate with responses that include the same suspicious strings. Monitor for outbound requests from browsers to unknown domains shortly after WOPI interactions.

• POST.*wopi.*<script
• wopi.*onerror=
• wopi.*javascript:
• document.write.*wopi

What your security team should do

• Prioritize upgrade of ONLYOFFICE Docs instances to the latest fixed release within the next 7 days given weaponized exploit maturity and rising EPSS
• Add WOPI endpoint traffic to web-application-firewall rules that block common reflected-XSS patterns
• Enable Content-Security-Policy headers with script-src set to 'self' and report-only mode for monitoring
• Review logs for recent suspicious POST requests to WOPI paths containing script tags or event handlers