A Server-Side Request Forgery vulnerability exists in the ONLYOFFICE ownCloud integration plugin version 9.12. This flaw allows authenticated administrators to manipulate the plugin's backend endpoint. The endpoint fails to properly validate the user-supplied document server URL before initiating outbound connections. An attacker can exploit this by providing arbitrary URLs, including internal network hosts or localhost addresses. This is achieved by sending crafted configuration requests to a specific endpoint. The ownCloud server is then coerced into issuing arbitrary network requests to attacker-controlled destinations. This enables the attacker to use the ownCloud server as a proxy for malicious activities. Furthermore, differences in error messages allow for internal network reconnaissance and port enumeration. The vulnerability grants access to localhost services not reachable externally. While no official patch is available, disabling or removing the plugin is recommended as a mitigation. Implementing network-level egress controls to limit outbound connections is also advised.