ONLYOFFICE ownCloud Plugin Has an SSRF Hole. Your Server Can Scan the Network

• The Mess: ONLYOFFICE’s ownCloud integration plugin 9.12 fails to properly validate the Document Server URL. An authenticated administrator can turn the ownCloud server into a network request proxy.
• The Damage: CVE-2026-84282 can expose localhost services, probe internal hosts and enumerate TCP ports that should never be reachable from the Internet.
• The Fix: Disable or remove the vulnerable plugin until a vendor fix is available, and restrict outbound connections from the ownCloud server.

ONLYOFFICE is supposed to handle documents.

Its ownCloud integration can also be persuaded to talk to machines it was never supposed to reach.

The problem sits in the plugin’s configuration flow.

When an administrator configures the ONLYOFFICE Document Server, the plugin accepts a server URL and tries to connect to it from the ownCloud host.

That URL is not adequately validated.

CVE-2026-84282 affects version 9.12 of the ONLYOFFICE ownCloud Integration plugin. CERT/CC published the vulnerability on September 8, 2026, assigning it the identifier VU#943094.

The Endpoint Is the Interesting Part

The vulnerable functionality is exposed through:

/apps/onlyoffice/ajax/settings/address

An attacker who controls the relevant administrator-level request can provide a crafted Document Server address.

The ownCloud server then makes the outbound connection itself.

That changes the attacker’s position.

Instead of trying to reach an internal service directly, the attacker makes the compromised application reach it on their behalf.

CERT/CC specifically reports that the server can be forced to connect to:

• localhost services;
• internal network hosts;
• attacker-controlled destinations.

The response behavior can also reveal whether a TCP port is open or closed.

That gives an attacker a primitive internal network scanner running from the ownCloud server.

SSRF Is the Real Problem

This is a classic Server-Side Request Forgery condition.

The attacker supplies the destination.

The server performs the connection.

The security boundary gets crossed because the server has network visibility that an external attacker normally doesn’t have.

That can expose services bound to 127.0.0.1, internal administration interfaces, development services or other systems sitting behind firewall rules.

The vulnerable endpoint does not need to provide a shell.

It doesn’t need direct file access.

It only needs permission to make network connections.

Once that primitive exists, the attacker can start mapping what lives behind the application.

No Official Fix Yet

This part makes the story considerably worse.

CERT/CC says it was unable to reach the vendor during coordinated disclosure and that no official patch was available when the vulnerability note was published.

The recommended mitigation is to disable or remove the plugin and restrict outbound network access from the ownCloud server.

The public ONLYOFFICE repository does contain newer releases, including 9.12.1, but the available release information does not establish that the SSRF described by CVE-2026-84282 has been fixed there.

So administrators should not assume that simply moving from 9.12 to another plugin build eliminates the vulnerability without explicit confirmation.

What Administrators Should Check

If the plugin is deployed, check:

• installed ONLYOFFICE ownCloud Integration version;
• administrator access to the integration settings;
• requests hitting /apps/onlyoffice/ajax/settings/address;
• unusual outbound connections from the ownCloud server;
• connections to localhost and RFC1918/private address space;
• unexpected TCP probes against internal systems;
• firewall and proxy logs around the ownCloud host.

Network egress filtering is particularly useful here.

An ownCloud server rarely needs unrestricted access to every machine inside the network.

Restrict what it can reach.

That limits the usefulness of an SSRF even when the application itself has a bug.

Why This One Matters

The vulnerability does not require the attacker to expose the internal service directly.

The ownCloud server already has access.

That makes the application an unwilling network relay.

A vulnerable instance sitting on a segmented corporate network can therefore provide reconnaissance opportunities that simply don’t exist from the public Internet.

And once an attacker discovers an internal service, the SSRF may become only the first step.

The next target could be an administrative interface, a development service, a monitoring endpoint or another vulnerable application.

Bugstoday Opinion

SSRF bugs are easy to underestimate because they don’t always end with instant remote code execution.

This one doesn’t need to.

An Internet-facing collaboration server with access to internal networks is already a useful reconnaissance platform for an attacker.

CVE-2026-84282 also has the uncomfortable combination of a fresh disclosure, a specific exploitable endpoint and no confirmed vendor patch at publication time.

That is enough to take it seriously.

Bugstoday verdict: if ONLYOFFICE ownCloud Integration 9.12 is running in your environment, don’t wait for somebody to prove the SSRF can be chained into something worse. Disable it, restrict egress and investigate the logs.

Today’s Bugs. Tomorrow’s Breaches.

Technical Sources

CERT/CC — VU#943094
CVE.org / MITRE — CVE-2026-84282
ONLYOFFICE — onlyoffice-owncloud repository
NVD — CVE-2026-84282