PatchTheCVEdzzoffice vulnerabilities and fixes
Recent CVEs affecting dzzoffice, with upgrade or downgrade steps. 5 tracked.
dzzoffice has 5 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 3. Most recent: 2025-11-18. Highest priority: CVE-2025-63695 (score 53/100).
- CVE-2025-63695 CRITICAL 9.8 UPGRADE DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php.
- CVE-2025-63694 CRITICAL 9.8 UPGRADE DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage.
- CVE-2025-63693 MEDIUM 5.4 UPGRADE The comment editing template (dzz/comment/template/edit_form.htm) in DzzOffice 2.3.x lacks adequate security e
- CVE-2024-41376 HIGH 8.8 DOWNGRADE dzzoffice 2.02.1 is vulnerable to Directory Traversal via user/space/about.php.
- CVE-2024-29273 MEDIUM 6.1 DOWNGRADE There is Stored Cross-Site Scripting (XSS) in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XS
FAQ
How do I fix dzzoffice vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is dzzoffice being exploited right now?
None of the tracked dzzoffice CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which dzzoffice CVE should I patch first?
CVE-2025-63695 currently ranks highest (53/100): DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php..