CVE-2026-107781criticalCWE-918

CVE-2026-107781: critical vulnerability in dromara skyeye

Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById

Published · Updated

Follow this CVE+ Monitor skyeye

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.1epss 0.3%
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server fetch internal URLs and overwrite any user's stored file, then read results via queryFileToShowById.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
dromara · skyeye
Related CVEs — dromara skyeye

In the same product, most dangerous first.

CVE-2026-107780CRITICALDromara Skyeye Unauthenticated OS Command Injection via textToSpeech format ParameterEPSS 2.1%CVE-2026-107779CRITICALDromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCEEPSS 0.5%CVE-2026-110609HIGHDromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword ParameterEPSS 0.5%