CVE-2025-10254 | Ascensio System SIA OnlyOffice up to 12.7.0 SVG Image Messages.aspx cross site scripting

A vulnerability has been found in Ascensio System SIA OnlyOffice up to 12.7.0 and classified as problematic. This issue affects some unknown processing of the file /Products/Projects/Messages.aspx of the component SVG Image Handler. Performing manipulation results in cross site scripting.

This vulnerability was named CVE-2025-10254. The attack may be initiated remotely. In addition, an exploit is available.

The vendor was informed early about this issue and replied: “We are already working on this case, and the issues will be resolved in one of the upcoming patches.”