Description

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server fetch internal URLs and overwrite any user's stored file, then read results via queryFileToShowById.

Related CPE's

Could not find any relations

References

https://github.com/dromara/skyeye

https://github.com/dromara/skyeye/blob/003549ae5615bd114ba5bb8ddf6a8e8ead97c321/skyeye-adm/adm-pro/src/main/java/com/skyeye/eve/diskcloud/service/impl/FileConsoleServiceImpl.java#L533-L556

https://github.com/dromara/skyeye/issues/29

https://www.vulncheck.com/advisories/dromara-skyeye-unauthenticated-ssrf-and-file-overwrite-via-edituploadofficefilebyid

Weaknesses

[email protected]

Primary
CWE-918

CVSS impact metrics

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

7.4 · High

Information

Source identifier

[email protected]

Vulnerability status

Deferred

Published

2026-10-08T21:17:53.080Z

11 hours ago

Last modified

2026-10-08T21:27:15.010Z

11 hours ago