On October 8, 2026, CISA added CVE-2021-3199 to the Known Exploited Vulnerabilities catalog. The federal remediation due date is October 11, 2026 — tomorrow for U.S. civilian agencies under Binding Operational Directive rules. HKCERT and other advisories describe the issue bluntly: ONLYOFFICE Docs contains a path traversal that can occur when JWT is used, via a /.. sequence in an image upload parameter, and that path can lead to remote code execution. Affected Document Server builds are versions earlier than 5.6.3. The fix is to run 5.6.3 or later. If your product embeds ONLYOFFICE, ships a customer-managed docs container, or runs Document Server beside a Next.js / Nest backend for contract editing, this is not a "legacy CMS" footnote. It is a same-week patch sprint with evidence preservation, because KEV listing means exploitation is confirmed — not theoretical.
What the vulnerability is (and is not)
CVE-2021-3199 is an older Document Server flaw that resurfaced operationally when CISA documented active exploitation in October 2026. The dangerous combination is JWT-enabled image upload handling plus directory traversal in the upload parameter. That is why "we turned JWT on for security" is not a shield by itself — JWT authenticity does not automatically prevent a path traversal bug in the upload handler. NVD and public changelogs point teams at Document Server 5.6.3 as the remediating line. Treat anything older as out of support for this advisory. Do not invent side-channel "maybe we are fine" stories: inventory the running image tag and compare it to 5.6.3.
A 48-hour patch plan for SaaS teams
Hour 0–2: inventory. List every environment that runs ONLYOFFICE Document Server or DocumentServer-derived images (prod, staging, customer VPCs, demo boxes). Capture image digests, version strings from the admin UI or /info endpoints, and whether JWT is enabled for uploads. Hour 2–8: patch. Upgrade to Document Server 5.6.3 or a current maintained release your vendor supports. Rebuild containers, rotate any shared JWT secrets used for document callbacks, and redeploy through the normal pipeline — not a hot SSH edit on a single box. Hour 8–24: verify. Confirm the version string in every cluster. Re-test document open/save, conversion, and editor embedding. Watch error rates on upload endpoints. Hour 24–48: hunt. Review logs for image-upload requests containing /.. or unexpected write paths under the Document Server data directory. Preserve logs and disk snapshots before you wipe anything if you see anomalies. Federal KEV entries often expect forensic triage thinking even when you are not BOD-bound — crash dumps and upload logs disappear when you rebuild casually.
# Example inventory (adjust for your compose/k8s layout)
docker ps --format '{{.Image}}\t{{.Names}}' | rg -i 'onlyoffice|documentserver'
# Or in Kubernetes
kubectl get deploy,sts -A -o wide | rg -i 'onlyoffice|documentserver'
# After upgrade, confirm version from the running container docs/admin endpoint
# and pin the image tag in Git — never float :latest for Document Server.Product and customer communication
If customers self-host Document Server under your helm chart, ship a patched chart and a one-page advisory: CVE ID, fixed version, how to upgrade, and what log patterns to review. If you host Document Server multi-tenant, say clearly that you patched shared infrastructure and whether tenant data volumes were reviewed. Avoid vague "we take security seriously" language — buyers reading KEV alerts want version numbers and dates.
Founder takeaway
CVE-2021-3199 is now a CISA KEV item with an October 11, 2026 federal due date. Upgrade every ONLYOFFICE Document Server instance below 5.6.3, rotate JWT secrets used for editor callbacks, and hunt upload logs for traversal patterns before you discard evidence. Self-hosted office stacks sit next to contracts and PII — treat this like an application RCE, because that is what the advisories describe.
How this shows up in modern SaaS architectures
ONLYOFFICE Document Server rarely sits alone. Agencies embed it behind a signed editor config from a Nest or Rails API. Product teams run it beside object storage for document blobs. Some customers insist on VPC-installed charts so contracts never leave their cloud. Each pattern has a different blast radius. Shared multi-tenant Document Server means one unpatched node threatens every tenant's drafts. Per-customer VPCs mean your helm chart and upgrade runbook are the product — if the chart still pins 5.5.x, you shipped the CVE to them. Also inventory "forgotten" demo and sales-engineer boxes. KEV actors scan; they do not care that a host was only for a week-long POC. If it still answers on 443 with an old Document Server banner, it is in scope.
JWT configuration deserves a deliberate review. Teams enable JWT to stop anonymous editor abuse, then assume upload paths are safe. CVE-2021-3199 is a reminder that authentication on the request does not remove path-traversal bugs in the handler. After you patch, rotate the JWT secret used between your app and Document Server, invalidate long-lived editor configs, and confirm callbacks still verify signatures.
Evidence you will want for customers and auditors
Write a short internal note before you need it: CVE identifier, prior versions in production, upgrade timestamp per environment, who approved the change, and whether log review found traversal attempts. Attach container digests. If a customer security questionnaire asks about KEV response times next quarter, you will be glad you kept the note. If you suspect exploitation, snapshot volumes before rebuilds. Upload directories, core dumps, and reverse-proxy logs are the first things blue-green deploys erase. Preserve first, patch second, communicate third.
Finally, put Document Server on the same vulnerability SLA as your primary API. Many SaaS teams patch Node weekly and leave office stacks for "infra someday." CISA's October 8 listing and October 11 due date compress that someday into a weekend. Add an automated check that fails when the running Document Server version parses older than your approved floor.
