ONLYOFFICE Document Server has a high-severity flaw (CVE-2026-110385): a Document Builder request can overwrite its own config file and run commands on the server. Affects every self-hosted version before 10.0. Fix: upgrade to 10.0 and enable inbound token validation. https://suriq.io/blog/onlyoffice-cve-2026-110385-document-builder-rce #CVE #infosec #cybersecurity