Changelog

New features

All Editors

• Added support for the Data Table chart element with the ability to add and configure text and graphic parameters.
• Updated the plugin marketplace design: added a left panel for switching categories.
• Added conversion of SVG images to shapes.
• Added the Download button to the top toolbar.

Document Editor

• Added the horizontal line settings window.
• Implemented clipping of text by lines in a paragraph with exact line spacing.
• Added support for the keepNext parameter for tables, as well as for paragraphs and tables inside block content controls.
• Improved support for graphic equations and other inline objects in right-to-left (RTL) text.
• Implemented a table row option that prevents a row from breaking across pages.
• Added items for continuing a list or restarting numbering to the Paste Special menu.
• Implemented the ability to go to another user's cursor and follow it during co-editing.

Spreadsheet Editor

• Added range highlighting in the formula bar.
• Added saving to the XLS format.
• Sped up some operations by storing styles and data separately.
• Added an option to enable and disable AutoComplete for cell values.
• Added tooltips for constants in function arguments (the AGGREGATE function).
• Added an animated selection border after copying or cutting.
• Implemented support for sheet background when opening and saving files.
• Improved performance of array formulas that reference entire columns or rows (ROW, COLUMN, SEQUENCE, SUM, SUMPRODUCT, etc.): calculations are faster and use less memory.
• Extended the capabilities for working with hidden rows and columns, including unhiding hidden edge rows and columns via the context menu.

Presentation Editor

• Extended print settings: added modes for printing notes, handouts, and outline, as well as printing hidden slides, slide background and frame, comments, slide numbers on handouts, and fitting to the page size.
• Added view modes: Outline, Notes, Handout Master, and Notes Master.
• Added the Reading View mode.
• Added the Animated and Video buttons to the File menu for exporting a presentation with a choice of slide range, resolution, slide duration, and format.
• Set a separate default duration for each transition type.

Forms

• Added the ability to save a signature in signature fields and reuse it from the list of saved signatures.
• Added an option to enable and disable spell checking when filling out a specific form.

PDF Editor

• Implemented removal of annotations in the Redact area.
• Added the ability to remove metadata from a document using the Redact feature.
• Added the annotation settings panel.
• Added the ability to insert a signature into a document via the Comment tab.
• The Comments panel now displays all annotations indicating their type.
• Added the ability to edit PDF form actions via Advanced Settings in the form settings panel.
• Implemented creating and filling out forms by roles, as well as collecting data from filled-out forms.
• Added recognition of tables with visible borders in the Edit Text mode.
• Added the signature field to the Forms tab in the Edit PDF mode.
• Added field visibility options to the right form settings panel.

Convert

• Added support for the OFD format: files can be opened for viewing and converted to other formats in the same way as XPS.

Security

• Fixed XSS vulnerability in hyperlinks in DOCX documents.
• Fixed CVE-2022-3602 and CVE-2022-3786 vulnerabilities in OpenSSL in the Docker image.
• Fixed CVE-2022-23308 vulnerability during document conversion.
• Fixed macro sandbox bypass.
• Fixed incorrect memory write when converting XLS to XLSX.
• Fixed XSS vulnerability in the Name field when creating an AI assistant.
• Fixed authorization bypass when printing PDF.
• Fixed converter crash when processing circular style inheritance chains in DOCX.
• Fixed stack buffer overflow when reading OLE data during conversion of legacy format documents.
• Fixed heap buffer overflow when rendering image masks in PDF.
• Fixed macro sandbox bypass with access to cookies.
• Fixed access to OS files via the native.GetFileBinary method of the Document Builder API.
• Fixed the possibility of using an editor token to access Document Builder.
• Fixed SSRF vulnerability in the /ai-proxy endpoint.
• Fixed out-of-bounds read when converting DOC to DOCX.
• Fixed out-of-bounds read when processing PPT metafiles, which led to memory disclosure in the resulting PPTX.
• Fixed out-of-bounds read when parsing character formatting in DOC files.
• Fixed out-of-bounds read when parsing the piece table in DOC files.
• Fixed execution of embedded JavaScript in PDF documents.
• Fixed SSRF vulnerability in WOPI endpoints.
• Fixed double free when converting some DOCX files.
• Fixed out-of-bounds read when parsing the font table in DOC files.
• Fixed heap out-of-bounds write caused by integer overflow during document conversion.
• Fixed XSS vulnerability in the function arguments window in the Spreadsheet Editor.
• Fixed execution of malicious JavaScript added to PDF file actions.
• Fixed path traversal vulnerability when processing HML files.
• Fixed arbitrary file write when extracting archives during conversion.
• Fixed local file read during EPUB conversion.
• Fixed the possibility of creating the runtime.json file via a Document Builder request (CVE-2026-110385).
• Fixed XSS vulnerability in the Document Editor via a font or style name in the Review panel.
• Fixed execution of an arbitrary script when opening the version history panel.
• Fixed reflected XSS vulnerability on the /baseurl page.
• Fixed issuing a token for an anonymous WOPI convert-and-edit request that was accepted by the Document Builder API.
• Fixed out-of-bounds read when converting XLS to XLSX.
• Fixed the possibility of specifying an arbitrary file system path in logging settings via runtime.json.
• Fixed co-editing session hijacking when working via WOPI.
• Fixed path traversal vulnerability in the template handler for creating new files via WOPI, which led to server configuration disclosure.
• Fixed vulnerabilities in the DocumentServer Docker image.
• Fixed stack buffer overflow when processing fonts in XPS files.
• Fixed XSS vulnerability in the HTML plugin when pasting into a document.
• Fixed out-of-bounds read when processing EMF+ bitmaps, which led to memory disclosure.
• Fixed an out-of-bounds read when converting XLSX to PDF on the server.
• Fixed out-of-bounds read when processing hyperlinks in XLS, which led to memory disclosure.
• Fixed out-of-bounds read when rendering WMF, which led to memory disclosure in the resulting document.
• Fixed privilege escalation via the documentserver-flush-cache script.
• Fixed the ability to export a document via the sendForm command in view-only mode with downloading disabled.

Back-end

• Updated the design of the server welcome page.
• Added conversion endpoints with direct file upload (multipart): POST /converter/from-file and POST /docbuilder/from-file.
• Added the aiSettings.enable parameter (true by default) for disabling AI. When it is set to false, AI Tools is excluded from /plugins.json, and requests to /ai-proxy are rejected.
• JWT is enabled by default in default.json.
• Removed the separate changes2forgotten script: changes are restored to forgotten when the server shuts down.
• Added the services.CoAuthoring.server.docbuilderEnable and services.CoAuthoring.server.convertServiceEnable parameters for disabling the public Document Builder and converter APIs (true by default).
• Added the coauth.connections metric with the mode (edit, liveview, view) and replica tags.
• Added integrity verification of downloaded files when the integrator provides the corresponding headers: the services.CoAuthoring.requestDefaults.checksumVerification parameter (true by default).
• Behavior change: /converter, /docbuilder, and /command no longer accept a token from the editor configuration. Added the operation field to the token, which is optional for these requests and required for /converter/from-file and /docbuilder/from-file.
• Behavior change: ipfilter rules are now required for WOPI; the allow: * rule is not enough, the host must be specified explicitly.
• Behavior change: only the log4js logging level can be changed via runtime.json.
• Behavior change: the default ONLYOFFICE Docs port for DEB and RPM installations is now 8083 instead of 80.
• The Docker installation command now works on both amd64 and arm64 without additional parameters.

Customization

• Added the editorConfig.customization.ai.disabled parameter for disabling AI Tools.
• Removed handling of the deprecated editorConfig.customization parameters: reviewDisplay, trackChanges, and showReviewChanges.

API

• Simplified calling editor methods from plugins: added the global Editor object whose methods return a Promise.
• Added the Editor.RunMacro method for executing editor API code with passing arguments and getting the result via await.
• Added the ApiShadow class for working with shadows.
• Added methods for configuring line arrows.
• Added methods for configuring the text of chart data labels.
• Added the ApiTextRange class to the Presentation, Spreadsheet, and PDF editors.
• Added methods for working with watermarks in the Document Editor.
• Added the ApiWatermarkSettings class and methods.
• Added classes for working with tables of contents and tables of figures in the Document Editor.
• Added methods for working with tables in the Document Editor.
• Added the ApiDropCap class for working with drop caps in the Document Editor.
• Added support for regular expression search in the ApiDocument.Search method.
• Added a method for selecting the current sentence in the Document Editor.
• Added the ability to set a style by name and to remove a style or numbering using the null value in the SetStyle (ApiParagraph, ApiParaPr, ApiRun, ApiTextPr), ApiParagraph.SetNumbering, and ApiParaPr.SetNumPr methods.
• Added the comparisonPr parameter to the Api.CompareDocuments and Api.MergeDocuments methods for configuring document comparison and merging, including the types of changes to track and the change author.
• Added the ApiHyperlink class and methods for working with hyperlinks in the Spreadsheet Editor.
• Added the ApiPageSetup, ApiPage, and ApiHeaderFooter classes for working with page settings and headers/footers in the Spreadsheet Editor.
• Added support for wildcards and regular expressions in ApiRange.Find and ApiRange.Replace.
• Added support for 2 to 30 ranges in Api.Intersect.
• The ApiRange.SetValue method now shifts relative references in a formula for a multi-cell range and returns false if the value is not written.
• The ApiRange.GetFormula method now returns an array of formulas for multiple cells.
• Added new methods in the Spreadsheet Editor.
• Added methods for working with the StopIfTrue property of conditional formatting rules.
• Added methods for grouping and ungrouping objects in the Spreadsheet Editor.
• Removed the Spreadsheet Editor's own ApiColor class; the common ApiColor class is used instead. The ApiColor.GetRGB method now returns an {r, g, b} object instead of a number.
• Added methods for working with presentations.
• Added methods for traversing the presentation structure.
• Added methods for working with tables in the Presentation Editor.
• Added plugin methods for the Presentation Editor.
• Added the SearchNext plugin method for the PDF Editor.
• Added a method for getting the selection on a PDF page.
• Added the ApiSignatureField class and methods for working with signature fields in the PDF API.
• Added the ApiActionCollection class for getting, adding, replacing, and removing PDF form widget actions.
• Added PDF form action classes and methods.

See changelog on GitHub

New features

All Editors

• Added Croatian language interface translation (hr-HR, Hrvatska).
• Moved chart settings from the right panel to a separate Chart design tab.

Document Editor

• Implemented the ability to add a horizontal line.

Spreadsheet Editor

• Added the Dark mode support for the sheet.

Presentation Editor

• Added 25 new presentation design themes.
• Added 20 new slide transitions, grouped by category.

Forms

• Implemented saving the signature image to localStorage. Now when filling in the signature field, the last selected image is used by default.
• Added the "Send for signing" and "Filling status" panels.

Security

• Fixed out-of-bounds read vulnerabilities when converting XLS to XLSX in the following functions: ChartSheetSubstream::recalc, TextPropsStream::readFields, MetroBlob::ReadComplexData, SUPBOOK::serialize_book and ATTACHEDLABEL::serialize_rPr.
• Fixed an XSS vulnerability via unsafe output in Convert-and-edit-wopi.ejs.
• Fixed a vulnerability in GUID generation that allowed an attacker to calculate GUIDs based on their creation time.
• Fixed a vulnerability that allowed bypassing macro sandbox restrictions and accessing environment objects via sloppy-mode this and eval.
• Fixed a potential crash or file corruption when processing PDFs with embedded fonts.

Back-end

• Removed the limitation of 20 simultaneously opened documents.
• Removed code minification to simplify support and improve readability.
• Consolidated components into a single process to optimize resource consumption and simplify working with the application.
• Removed dependency on RabbitMQ due to component consolidation.
• Removed dependency on databases due to component consolidation.

Customization

• Added the disable parameter to the plugins section of the editors configuration — an array of plugin IDs that are blocked on load and hidden in the interface.

API

• Added new plugin methods for moving the cursor inside or outside a field.
• Extended GroupActions options for controlling scrolling and cursor position.
• Added a new class for the signature form.
• Added methods for filling and retrieving form data.
• Added a method for creating a form.
• Added a new method to check whether the form has been filled in.
• Added a method for retrieving the highlight color of forms without a role.
• Added a method for retrieving the highlight color of a form.
• Added methods for managing the color of content controls.
• Added new methods for the ApiWorksheet class.
• Added new class ApiListObject and methods.
• Added new class ApiListColumn and methods.
• Added new class ApiListRow and methods.
• Added new class ApiSort and methods.
• Added new class ApiSortFields and methods.
• Added new class ApiSortField and methods.
• Added missing methods for getting paragraph settings.
• Improved behavior of several Get methods on the ApiTextPr object when it belongs to a style or default formatting parameters rather than a paragraph.
• Added methods for working with text form format and the list of allowed characters.
• Added new methods.
• Added methods for managing cell size.
• Added the GoToPage plugin method for navigating to a specific page.

See changelog on GitHub