CVE-2026-93643
CRITICAL
NVD
CVSS Score
9.8
Severity
CRITICAL
Published
Sep 25, 2026
Vendor
unknown
Description
When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra.