{"metadata": {"vulnerability": "cve-2026-110385", "count": 15, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-10-14T00:24:52.796Z", "date_only": false, "value": "2026-10-14T00:24:52.796Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-110385", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T00:24:53.582Z", "date_only": false, "value": "2026-10-14T00:24:53.582Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-110385", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T00:24:53.582Z", "date_only": false, "value": "2026-10-14T00:24:53.582Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "cve-2026-110385", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T01:03:13.746Z", "date_only": false, "value": "2026-10-14T01:03:13.746576Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3mxsdzgje7v2z", "record": "CVE-2026-110385", "field": "creation_timestamp", "uuid": "aaf8aa4e-287e-4e36-8ece-a9a856e80c64", "content": "ONLYOFFICE Document Server has a high-severity flaw (CVE-2026-110385): a Document Builder request can overwrite its own config file and run commands on the server.\n\nAffects every self-hosted version before 10.0.\n\nFix: upgrade to 10.0 and enable inbound token validation.", "url": "https://bsky.app/profile/suriq.io/post/3mxsdzgje7v2z"}, {"timestamp": "2026-10-14T01:17:06Z", "date_only": false, "value": "2026-10-14T01:17:06Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-4J4F-MQ3P-MC2R", "record": "GHSA-4J4F-MQ3P-MC2R", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T01:17:06.337Z", "date_only": false, "value": "2026-10-14T01:17:06.337", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110385", "record": "FKIE_CVE-2026-110385", "field": "published"}, {"timestamp": "2026-10-14T01:56:14.671Z", "date_only": false, "value": "2026-10-14T01:56:14.671179Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/hjhmsmbu4hcp3", "record": "CVE-2026-110385", "field": "creation_timestamp", "uuid": "98b09329-cc57-481e-8f61-268edf8116f3", "content": "CVE-2026-110385 - ONLYOFFICE Document Server Remote Code Execution Vulnerability\nCVE ID : CVE-2026-110385\n \n Published : Oct. 14, 2026, 12:24 a.m. | 1\u00a0hour ago\n \n Description : A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an ...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/hjhmsmbu4hcp3"}, {"timestamp": "2026-10-14T03:30:38Z", "date_only": false, "value": "2026-10-14T03:30:38Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-4J4F-MQ3P-MC2R", "record": "GHSA-4J4F-MQ3P-MC2R", "field": "published"}, {"timestamp": "2026-10-14T03:30:38Z", "date_only": false, "value": "2026-10-14T03:30:38Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-4J4F-MQ3P-MC2R", "record": "GHSA-4J4F-MQ3P-MC2R", "field": "modified"}, {"timestamp": "2026-10-14T16:14:07.917Z", "date_only": false, "value": "2026-10-14T16:14:07.917182Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440148105963590", "record": "CVE-2026-110385", "field": "creation_timestamp", "uuid": "ee09e032-4e3d-4f97-a0a0-5b23cf5e5169", "content": "CVE-2026-110385  A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled converter XML supplied through the optional third argument of builder.SaveFile(). By injecting a duplicate m_sFileTo element, an attacker can override the server-generated output path and write arbitrary content outside the designated job directory. This allows the attacker to overwrite the runtime.json configuration file, modify the Document Builder executable path and arguments, and execute arbitrary commands when a subsequent Document Builder job is processed.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110385https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#ONLYOFFICE #DocumentServer#CVE_2026_110385#bot", "url": "https://infosec.exchange/users/cve/statuses/117440148105963590"}, {"timestamp": "2026-10-14T17:23:56.682Z", "date_only": false, "value": "2026-10-14T17:23:56.682389Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-110385", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-14T17:23:56.682Z", "date_only": false, "value": "2026-10-14T17:23:56.682389Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110385", "record": "FKIE_CVE-2026-110385", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T17:24:17.430Z", "date_only": false, "value": "2026-10-14T17:24:17.430Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-110385", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-14T17:24:17.430Z", "date_only": false, "value": "2026-10-14T17:24:17.430Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-110385", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T18:17:33.853Z", "date_only": false, "value": "2026-10-14T18:17:33.853", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110385", "record": "FKIE_CVE-2026-110385", "field": "lastModified"}]}