Correction: PowerFolder Server is affected — please block /wopi/ now

Please block all requests to the path /wopi/, including all sub-paths, right away at your reverse proxy or firewall — for your document server as well. If in doubt, take the server off the network until the security update is installed.

A correction to our earlier statement: that self-hosted servers are not affected is not correct in the light of new findings. The vulnerability the attacker used to get into our cloud affects all PowerFolder Servers and all versions.

This applies even if online document editing is not set up or has been switched off in the settings: switching it off in the settings does not protect you. The block has to take effect in front of the server, that is, in the reverse proxy or the firewall.

Operators receive the details directly from us. A security update is in preparation. For questions please write to support@powerfolder.com.

Background: security incident update of 6 November 2026