PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-107781 dromara CVE debrief

CVE-2026-107781 Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-10-08T20:15:56.039Z and has not been modified since then. This critical vulnerability allows unauthenticated attackers to perform SSRF and file overwrite attacks via editUploadOfficeFileById, potentially leading to internal URL fetching and arbitrary file overwrite. Defenders should prioritize verifying exposure and assessing potential impact.

Vendor
dromara
Product
skyeye
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-08
Original CVE updated
2026-10-09
Advisory published
2026-10-08
Advisory updated
2026-10-09

Who should care

Defenders responsible for Dromara Skyeye deployments should assess exposure and potential impact, focusing on unauthenticated access and file overwrite risks. They should prioritize verifying exposure, assessing potential impact, and implementing compensating controls to limit SSRF and file overwrite risks. Additionally, defenders should review relevant monitoring, detection, and logs for exposed assets that need extra review.

Why it matters

CVE-2026-107781 is a critical vulnerability in Dromara Skyeye that allows unauthenticated attackers to perform SSRF and file overwrite attacks via editUploadOfficeFileById. Defenders should prioritize verifying exposure and assessing potential impact.

  • Unauthenticated SSRF and file overwrite risks
  • Potential for internal URL fetching and arbitrary file overwrite
  • Need for compensating controls to limit SSRF and file overwrite risks
  • Monitoring for suspicious activity related to editUploadOfficeFileById

Technical summary

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server fetch internal URLs and overwrite any user's stored file, potentially leading to security risks. This vulnerability highlights the need for defenders to verify exposure and assess potential impact on their systems, focusing on unauthenticated access and file overwrite risks.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on unauthenticated access and file overwrite risks.

Recommended defensive actions

  • Verify if the Dromara Skyeye instance is exposed to unauthenticated access
  • Assess potential impact of file overwrite on the system
  • Implement compensating controls to limit SSRF and file overwrite risks
  • Monitor for suspicious activity related to editUploadOfficeFileById
  • Review relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321, and the potential for unauthenticated SSRF and file overwrite via editUploadOfficeFileById.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-107781 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-107781

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-107781 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-107781

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107781.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/dromara/skyeye/issues/29

    Supplemental source - issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/dromara/skyeye/blob/003549ae5615bd114ba5bb8ddf6a8e8ead97c321/skyeye-adm/adm-pro/src/main/java/com/skyeye/eve/diskcloud/service/impl/FileConsoleServiceImpl.java

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/dromara/skyeye

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/dromara-skyeye-unauthenticated-ssrf-and-file-overwrite-via-edituploadofficefilebyid

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.