CVE-2026-107781

Executive Summary

CVE-2026-107781 is a server-side request forgery (SSRF) combined with a missing authorization flaw in Dromara Skyeye, affecting the OnlyOffice save callback handler editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to force the server to fetch attacker-controlled or internal URLs and overwrite any user's stored file, then retrieve the results via queryFileToShowById. With a CVSS score of 7.4 and no patch currently available, any internet-exposed Skyeye deployment is at risk of data tampering and internal network reconnaissance.

Technical Analysis

The vulnerability resides in the OnlyOffice save callback functionality of Dromara Skyeye. Two distinct weaknesses are chained:

1. Server-Side Request Forgery (CWE-918): The editUploadOfficeFileById endpoint accepts a url parameter without validating or restricting the destination. Because the server processes this parameter to fetch a remote resource, an attacker can direct it toward internal-only addresses (e.g., cloud metadata endpoints, internal admin panels, or localhost services). This allows the attacker to probe internal networks and potentially exfiltrate responses through the application's own file storage.

2. Missing Authorization: The same endpoint lacks an authentication or authorization check. The key parameter, which normally binds an edit session to a specific stored file, is attacker-controllable. By supplying an arbitrary key, an unauthenticated attacker can cause the server to overwrite the file associated with that key — regardless of which user owns it.

The combination means the callback can be invoked by anyone, with any target URL and any file identifier. The queryFileToShowById endpoint (also referenced in the description) provides a read primitive, allowing the attacker to retrieve the results of the SSRF fetch or confirm the overwritten content.

The CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N indicates:

• Network exploitable (AV:N) — the callback is reachable over the network.
• High attack complexity (AC:H) — successful exploitation likely requires knowledge of valid key values or timing/state conditions, consistent with the "missing authorization" and callback interaction model.
• No privileges required (PR:N) and no user interaction (UI:N).
• High confidentiality and integrity impact (C:H/I:H) — internal data can be read and arbitrary stored files can be overwritten.
• No availability impact (A:N).

The vulnerability class is well-understood: SSRF paired with broken access control in a file-processing callback. No public proof-of-concept, Nuclei template, or exploit code is currently available.

Exploitation Scenarios

Because no public PoC exists, the attack chain below is inferred strictly from the NVD description and the vulnerability class.

1. Reconnaissance / Target Identification: The attacker identifies an internet-facing Dromara Skyeye instance, for example via the Shodan dorks listed above. The OnlyOffice integration implies a collaborative document-editing feature is enabled.

2. Triggering the Flaw: The attacker sends an unauthenticated request to the OnlyOffice save callback editUploadOfficeFileById, supplying:

   • url — set to an internal or attacker-controlled resource.
   • key — set to a value corresponding to a victim's stored file.

   No credentials or session tokens are required due to the missing authorization check.

3. Payload / Execution (vulnerability-class level): The server-side component processes the supplied url and performs an outbound HTTP request to that destination — the classic SSRF mechanism. Simultaneously, because the key is not bound to the caller's identity, the save callback logic writes the fetched (or attacker-supplied) content into the file mapped to that key, overwriting the legitimate user's document.

4. Post-Exploitation Impact: The attacker uses queryFileToShowById to read back the stored content. This yields two outcomes:

   • Internal data retrieval — responses from internal services reached via SSRF become readable through the file-viewing endpoint (confidentiality breach).
   • Integrity compromise — arbitrary user files are overwritten, enabling document tampering, content injection, or planting malicious payloads in shared workspaces.

No public PoC is available; the attack chain is inferred from the vulnerability class and the endpoints named in the NVD description.

Impact Assessment

Exploitation allows unauthenticated attackers to (a) coerce the Skyeye server into making arbitrary outbound requests, enabling internal network enumeration and access to services not otherwise reachable, and (b) overwrite any user's stored file by manipulating the key parameter. The CVSS base score of 7.4 reflects high confidentiality and integrity impact with no availability impact. The blast radius includes all documents managed through the OnlyOffice integration on the affected instance, plus any internal systems reachable from the Skyeye host. Because the issue is unpatched, every deployment through the referenced commit remains exposed until mitigations are applied. No threat actor campaigns or exploitation-in-the-wild evidence have been observed to date.

Detection Guidance

Sigma Rule

title: Dromara Skyeye OnlyOffice SSRF and Unauthorized File Overwrite Attempt
id: 8f3c2a1e-5b4d-4e6f-9a7b-1c2d3e4f5a6b
status: experimental
description: Detects unauthenticated requests to the OnlyOffice save callback editUploadOfficeFileById with external or internal url parameters, indicative of CVE-2026-107781 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-107781
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
    - attack.t1190
    - cve.2026.107781
logsource:
    category: webserver
detection:
    selection_endpoint:
        cs-uri-stem|contains:
            - 'editUploadOfficeFileById'
            - 'queryFileToShowById'
    selection_params:
        cs-uri-query|contains:
            - 'url='
            - 'key='
    filter_internal:
        cs-uri-query|contains:
            - 'url=http://127.0.0.1'
            - 'url=http://localhost'
            - 'url=http://169.254.169.254'
            - 'url=http://10.'
            - 'url=http://192.168.'
            - 'url=http://172.16.'
    condition: selection_endpoint and selection_params
falsepositives:
    - Legitimate OnlyOffice callback traffic from trusted document servers
level: high

YARA Rule

rule CVE_2026_107781_Skyeye_SSRF_Callback
{
    meta:
        description = "Detects exploit attempts targeting Dromara Skyeye OnlyOffice callback SSRF and unauthorized file overwrite (CVE-2026-107781)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-107781"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ep1 = "editUploadOfficeFileById" ascii wide nocase
        $ep2 = "queryFileToShowById" ascii wide nocase
        $p1  = "url=" ascii nocase
        $p2  = "key=" ascii nocase
        $meta = "169.254.169.254" ascii
        $local = "127.0.0.1" ascii
        $rfc1918a = "192.168." ascii
        $rfc1918b = "172.16." ascii

    condition:
        (any of ($ep1, $ep2)) and (all of ($p1, $p2)) or
        (any of ($ep1, $ep2)) and (any of ($meta, $local, $rfc1918a, $rfc1918b))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-107781 Dromara Skyeye OnlyOffice SSRF via editUploadOfficeFileById"; flow:established,to_server; http.uri; content:"editUploadOfficeFileById"; http.uri; content:"url="; http.uri; content:"key="; pcre:"/(url=(http|https)(:\/\/)?(127\.0\.0\.1|localhost|169\.254\.169\.254|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.))/i"; classtype:web-application-attack; reference:cve,2026-107781; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-107781; sid:2026107781; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where url.path : "editUploadOfficeFileById" and url.query : "url=*" and url.query : "key=*" ]
  [ network where url.path : "queryFileToShowById" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:access
| eval uri_lower = lower(uri)
| where match(uri_lower, "edituploadofficefilebyid|queryfiletoshowbyid")
| where match(uri_lower, "url=") AND match(uri_lower, "key=")
| rex field=uri "url=(?<target_url>[^&]+)"
| where match(target_url, "(?i)(127\.0\.0\.1|localhost|169\.254\.169\.254|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)")
| stats count values(target_url) as targets by src_ip, uri
| sort -count

Wazuh OSSEC Rule

<group name="web,skyeye,">
  <rule id="100781" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>editUploadOfficeFileById|queryFileToShowById</url>
    <regex>url=(http|https).*(127\.0\.0\.1|localhost|169\.254\.169\.254|10\.|192\.168\.|172\.)</regex>
    <description>CVE-2026-107781: Possible Dromara Skyeye OnlyOffice SSRF and unauthorized file overwrite attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_107781,ssrf,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict network access to the Skyeye OnlyOffice callback endpoints (editUploadOfficeFileById, queryFileToShowById) so they are not reachable from untrusted networks.
   • Enforce authentication and authorization on the save callback — verify that the key maps to a file owned by (or shared with) the authenticated caller.
   • Apply egress filtering to block outbound requests from the Skyeye server to internal ranges (RFC1918, loopback, link-local 169.254.169.254) and to unexpected external hosts. Allowlist only legitimate OnlyOffice document server URLs.
   • Deploy the WAF/IDS rules above to detect and block callback requests containing internal URL targets.

2. Patch / Upgrade Steps:

   • No vendor patch is currently available. Monitor the Dromara Skyeye repository and NVD for an official fix. Until then, treat the affected commit range (through 003549ae5615bd114ba5bb8ddf6a8e8ead97c321) as vulnerable.
   • If a patched commit or release is published, validate that it introduces URL validation and per-user authorization on the callback, then upgrade immediately.

3. Long-Term Hardening:

   • Apply a strict URL allowlist/denylist for any server-side fetch functionality and resolve-then-validate destination IPs to defeat DNS rebinding.
   • Implement centralized authentication middleware that cannot be bypassed by individual callback handlers.
   • Segment the Skyeye deployment from sensitive internal networks and cloud metadata services.
   • Enable detailed access logging for all file callback endpoints and retain logs for forensic analysis.

References

• NVD — CVE-2026-107781: https://nvd.nist.gov/vuln/detail/CVE-2026-107781
• CWE-918: Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Dromara Skyeye project repository: https://github.com/dromara/skyeye
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-107781 not currently listed)

No threat actor campaigns or exploit-in-the-wild evidence have been identified for CVE-2026-107781 at this time.