Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Release: The Document Foundation LibreOffice < 26.2.5 Clear all filters
TI-2026-67609 CVE-2026-63270 · GHSA-p537-j8hg-x628

Environment and INI file values leak through LibreOffice documents

Priority LOW 28

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links.

CVSS 4.0MEDIUM 6.7 Local Low privileges User interaction EPSS 0.00116 Published 2026-10-05 Partial fix · < 26.2.5 CWE-200
TI-2026-67608 CVE-2026-63269 · GHSA-hx75-xjjr-jmv5

Local file read and SSRF in LibreOffice via HLS playlists

Priority LOW 28

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer.

CVSS 4.0MEDIUM 6.7 Local Low privileges User interaction EPSS 0.00109 Published 2026-10-05 Partial fix · < 26.2.5 CWE-200
TI-2026-67605 CVE-2026-63266 · GHSA-5436-5r9x-m4jv

Arbitrary file write via LibreOffice Calc data mappings

Priority LOW 29

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document.

CVSS 4.0MEDIUM 6.8 Local No auth User interaction EPSS 0.00156 Published 2026-10-05 Partial fix · < 26.2.5 CWE-22