Read the docs
TI-2023-27196 Aliases CVE-2023-49788

Improper handling of browser-side provided input in richdocuments path handling

Priority LOW 32CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Collabora Online is a collaborative online office suite based on LibreOffice technology. Unlike a standalone dedicated Collabora Online server, the Built-in CODE Server (richdocumentscode) is run without chroot sandboxing. Vulnerable versions of the richdocumentscode app can be susceptible to attack via modified client->server commands to overwrite files outside the sub directory the server has provided for the transient session. Files which can be accessed are limited to those that the server process has access to. The bug was fixed in Collabora Online - Built-in CODE Server (richdocumentscode) release 23.5.602. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

EPSS 0.00496 42nd percentileScored 2026-11-07
Fix Fixed online (CollaboraOnline): 23.5.602

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Collaboraonlinebefore 23.5.60223.5.602Patch availableCNA
  • online VendorCollabora Affected before 23.5.602 Fixed in 23.5.602 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:collaboraoffice:richdocumentscode:*:*:*:*:*:nextcloud:*:*before 23.5.602VulnerableCollaboraoffice
  • cpe:2.3:a:collaboraoffice:richdocumentscode:*:*:*:*:*:nextcloud:*:* Versions before 23.5.602 Vulnerable ·Collaboraoffice

Remediation

  • Fix · CNA online (CollaboraOnline) Fixed in 23.5.602

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-49788

References

Advisory 1

  • TI-2026-73868 Collabora Online Built-in CODE Server allows remote code execution KEVCVSS 4.0CRITICAL 9.2
  • TI-2026-19024 Collabora Online vulnerable to Authorization Bypass CVSS 3.1MEDIUM 5.3
  • TI-2021-12412 Unauthenticated attacker could gain access to currently open files CVSS 3.1CRITICAL 9.8
  • TI-2025-40711 Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy CVSS 4.0HIGH 7.2
  • TI-2023-16934 Collabora Online has Stored Cross-Site-Scripting vulnerability in admin interface CVSS 3.1HIGH 8.7
  • TI-2025-20570 Collabora Online Vulnerable to Arbitrary File Write CVSS 4.0HIGH 8.3
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences