CVE-2026-107781
Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById
CVSS Score
7.4
EPSS Score
0.0%
EPSS Percentile
0th
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server fetch internal URLs and overwrite any user's stored file, then read results via queryFileToShowById.
| CWE | CWE-918 |
| Vendor | dromara |
| Product | skyeye |
| Published | Oct 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for dromara skyeye
Be the first to know when new high vulnerabilities affecting dromara skyeye are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
dromara / skyeye
0 ≤ 003549ae5615bd114ba5bb8ddf6a8e8ead97c321
References
github.com: https://github.com/dromara/skyeye/issues/29 github.com: https://github.com/dromara/skyeye/blob/003549ae5615bd114ba5bb8ddf6a8e8ead97c321/skyeye-adm/adm-pro/src/main/java/com/skyeye/eve/diskcloud/service/impl/FileConsoleServiceImpl.java#L533-L556 github.com: https://github.com/dromara/skyeye vulncheck.com: https://www.vulncheck.com/advisories/dromara-skyeye-unauthenticated-ssrf-and-file-overwrite-via-edituploadofficefilebyid
Credits
Ikram-4