CVE-2018-10583

CVE-2018-10583 LibreOffice 6.0.3 및 Apache OpenOffice Writer 4.1.5가 악성 파일에 포함된 SMB 연결을 자동으로 처리하고 시작할 때 정보 노출 취약점이 발생합니다. 이는 ".odt XML 문서" 내의 "office:document-content" 요소에 포함된 "xlink:href=file://192.168.0.2/test.jpg"에서 확인됩니다. http://bit.ly/2w9mU1n...

CVE-2023-36664

CVE-2023-36664 : Ghostscript 원격 코드 실행 CVE-2023-36664에 대한 개념 증명 코드입니다. 사용법 .eps 파일에 페이로드를 삽입하려면: python3 poc.py -f "파일이름" --payload "명령어" python3 poc.py -f file.eps --payload firefox .eps 파일에 리버스 셸 페이로드를 삽입하려면: python3 poc.py -f "파일이름" --revshell --ip "IP" --port "포트" python3 poc.py -f file.eps...

USN-8868-1: LibreOffice vulnerabilities

It was discovered that LibreOffice incorrectly handled WMF image imports. An attacker could possibly use this issue to cause LibreOffice to crash, resulting in a denial of service, or execute arbitrary code. CVE-2026-63272 It was discovered that LibreOffice incorrectly handled PDF document import...

CVE-2026-63277

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in...

CVE-2026-63267

LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions...

CVE-2026-63269

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In...

CVE-2026-63266

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or...

CVE-2026-63268

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml...

CVE-2026-63269 LFI and GET SSRF via GStreamer and HLS playlists

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In...

CVE-2026-63269

On Linux , LibreOffice is vulnerable to Local File Inclusion (LFI) and GET Server-Side Request Forgery (SSRF) due to how it handles linked media via GStreamer . An attacker can provide a linked HLS playlist that causes GStreamer to read local files or remote URLs during document loading, potentia...

EUVD-2026-92420

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In...

CVE-2026-63267 LFI and GET SSRF via calcext:data-mappings and csv provider

LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions...

EUVD-2026-92419

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml...

CVE-2026-63268 LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml...

CVE-2026-63268

LibreOffice Calc is vulnerable to a Local File Inclusion (LFI) flaw when linking cell ranges to external data sources. An attacker can exploit the sql provider and sdbc:flat:file:// database href by naming a folder of local text files as a database. This allows a user to read local text files int...

EUVD-2026-92418

LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions...

CVE-2026-63267

LibreOffice Calc is vulnerable to Local File Inclusion (LFI) and GET Server-Side Request Forgery (SSRF) via the calcext:data-mappings and csv provider. The root cause is that the application automatically fetches external CSV data links saved in a document during the loading process. This allows ...

EUVD-2026-92417

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or...

CVE-2026-63266

LibreOffice Calc is vulnerable to an arbitrary file write due to how it handles external data source links. An attacker can use a document to open an embedded Firebird database , which may write files to any location the user has permissions to access. The vulnerability is caused by a lack of dir...

CVE-2026-63266 Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or...