Arbitrary file write via LibreOffice Calc data mappings
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 4 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
LibreOffice from 26.2 before 26.2.5 is affected. A LibreOffice Calc data link saved in a document could make an embedded Firebird database write files to any location the user can write to, because of path traversal (CWE-22). An attacker needs a user to open a crafted document, and no authentication is required.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or create files only inside its own private directory.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| The Document Foundation | LibreOffice | 26.2 to before < 26.2.5 | < 26.2.5 | Patch available | CNA |
- LibreOffice VendorThe Document Foundation Affected 26.2 to before < 26.2.5 Fixed in < 26.2.5 Patch available CNA
Remediation
Update LibreOffice from 26.2 to 26.2.5 or later. Red Hat lists Red Hat Enterprise Linux 6, 7, 8 and 9 as affected, with no fix plan available.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA LibreOffice (The Document Foundation) Fixed in < 26.2.5
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
The Document Foundation LibreOffice < 26.2.5
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2026-67610 Remote code execution in LibreOffice Calc via external data linksPriority LOW 39
- TI-2026-67609 Environment and INI file values leak through LibreOffice documentsPriority LOW 28
- TI-2026-67608 Local file read and SSRF in LibreOffice via HLS playlistsPriority LOW 28
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-05 Threatist record created from CVE-2026-63266
- 2026-10-05 Alias added: GHSA-5436-5r9x-m4jv
- 2026-10-06 Affected versions changed · Red Hat
- 2026-10-06 CVSS score added · Red Hat
More The Document Foundation vulnerabilities
- TI-2019-07233 LibreLogo global-event script execution CVSS 3.1CRITICAL 9.8
- TI-2018-12068 Path traversal in [UNKNOWN] libreoffice CVSS 3.0CRITICAL 9.8
- TI-2018-07474 An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache… CVSS 3.0HIGH 7.5
- TI-2019-07230 Code injection in Document Foundation LibreOffice CVSS 3.1CRITICAL 9.8
- TI-2018-05018 LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary… CVSS 3.0CRITICAL 9.8
- TI-2023-01118 Arbitrary file write in libreoffice CVSS 3.1MEDIUM 5.5
Sources
- CVE-2026-63266 · CVE Program
- CVE-2026-63266 · NVD
- FIRST EPSS
- GHSA-5436-5r9x-m4jv · GitHub Advisory Database · CC BY 4.0
- CVE-2026-63266 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences