CVE-2026-63267
Announced: Oct 5, 2026
Fixed in: LibreOffice 26.2.5/26.8.0
Description:
LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document.
Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document’s choosing.
In fixed versions external data links are updated under the same link update control as other links in a spreadsheet.
All users are recommended to upgrade to LibreOffice >= 26.2.5 or >= 26.8.0 to avoid this problem.
Credits:
Thanks to Thomas Rinsma and Edoardo Geraci from Codean Labs for reporting this issue.
Thanks to Caolán McNamara of Collabora Productivity for providing the fix.
References:
Sledujte nás