Is CVE-2026-107781 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107781 being exploited in the wild.

How severe is CVE-2026-107781?

High severity, with a CVSS score of 7.4, published 8 October 2026.

Which products and versions are affected?

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321.

Is there a fix for CVE-2026-107781?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-107781 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-107781?

Check whether you run Dromara Skyeye at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107781: Dromara Skyeye server-side request forgery and authorization bypass

CVE-2026-107781 · Severity: high · CVSS 7.4 · Published 2026-10-08

Dromara Skyeye is an intelligent office OA (office automation) system used by hospitals, schools, and enterprises to manage workflows and business processes. An unauthenticated attacker can exploit a flaw in the OnlyOffice file save callback to make the server fetch internal URLs and overwrite other users' files, potentially exposing sensitive business data.

Technologies: Dromara Skyeye. Vendors: Dromara.

Quick answers

Is CVE-2026-107781 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107781 being exploited in the wild.
How severe is CVE-2026-107781?: High severity, with a CVSS score of 7.4, published 8 October 2026.
Which products and versions are affected?: Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321.
Is there a fix for CVE-2026-107781?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-107781 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-107781?: Check whether you run Dromara Skyeye at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a server-side request forgery (SSRF) and missing authorization flaw in the editUploadOfficeFileById endpoint of the OnlyOffice save callback handler. Attackers can supply arbitrary url and key parameters without authentication to fetch internal resources and overwrite any user's stored files, then retrieve the results via queryFileToShowById. The vulnerable code path processes file save operations without proper authorization checks.

Affected products

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321

Timeline

2026-10-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.