A reported vulnerability in the ONLYOFFICE ownCloud integration plugin has been identified as a critical Server-Side Request Forgery (SSRF) flaw. The issue affects version 9.12 of the integration plugin and is tracked as CVE-2026-84282. At the time of publication, there had been no confirmed public exploits or PoCs.
The article notes that the vulnerability could allow an authenticated administrator to force the plugin to make arbitrary outbound network requests, effectively turning the ownCloud server into a proxy for probing internal hosts.
How the flaw works, according to the report, hinges on the plugin accepting a user-supplied document server URL during configuration without sufficiently validating it before initiating outbound connections. An attacker could submit crafted requests to the /apps/onlyoffice/ajax/settings/address endpoint, prompting the server to reach the supplied addresses.
The advisory also states that differences in error messages returned by the server could enable an attacker to distinguish open from closed TCP ports, facilitating internal port scanning. At present, Ascensio System SIA has not issued a patch for the plugin, and the vendor’s guidance is to disable or remove the integration until an official fix is available.
In parallel, security teams are advised to enforce strict network egress controls to limit outbound connections from the ownCloud server to trusted destinations only.