# CVE-2026-110385: ONLYOFFICE Document Server remote code execution in Document Builder API

Source: https://junglewise.ai/threats/cve-2026-110385-a-remote-code-execution-vulnerability-in-onlyoffice-document  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-110385 · Severity: info · Published 2026-10-14

ONLYOFFICE Document Server is a backend service that processes and converts office documents. A vulnerability in versions before 10.0.0 allows an authenticated attacker to execute arbitrary commands on the server by manipulating XML payloads sent through the Document Builder API, potentially enabling full system compromise.

Technologies: [ONLYOFFICE Document Server](https://junglewise.ai/threats/technologies/document-server). Vendors: [ONLYOFFICE](https://junglewise.ai/threats/vendors/onlyoffice).

## Quick answers

**Is CVE-2026-110385 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110385 being exploited in the wild.

**How severe is CVE-2026-110385?** Informational severity, published 14 October 2026.

**Which products and versions are affected?** ONLYOFFICE Document Server before 10.0.0.

**Is there a fix for CVE-2026-110385?** Yes: fixed in 10.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110385 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-110385?** Check whether you run ONLYOFFICE Document Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 10.0.0

## Technical details

The Document Builder API in Document Server fails to properly validate user-supplied converter XML in the optional third argument of builder.SaveFile(). By injecting a duplicate m_sFileTo element, an attacker can override the output path and write arbitrary files, including the runtime.json configuration file. This allows modification of the Document Builder executable path and arguments, leading to remote code execution as the ds service account when subsequent jobs are processed. The vulnerability requires valid Inbox-compatible JWT authentication.

## Affected products

- ONLYOFFICE Document Server before 10.0.0

## References

- [https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md](https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md)

## Related threats

- [ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.](https://junglewise.ai/threats/cve-2025-68936-onlyoffice-docs-before-9-2-1-allows-xss-via-the-color-theme-name)
- [ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer.](https://junglewise.ai/threats/cve-2025-68935-onlyoffice-docs-before-9-2-1-allows-xss-via-the-font-field-for)