Gotenberg < 8.34.0 - Local File Disclosure

Gotenberg before 8.34.0 allows SSRF and limited local file disclosure via its /forms/libreoffice/convert endpoint. When LibreOffice is used to convert user-uploaded DOCX files, external relationships within the document such as a:blip r:link TargetMode="External" can instruct LibreOffice to fetch...

CVE-2020-27603-bbb-libreoffice-poc

CVE-2020-27603-bbb-libreoffice-poc Proof of Concept of Libreoffice file exfiltration vulnerability in Big Blue Button These ODT files show how to exploit a file exfiltration vulnerability that can happen with server-side Libreoffice rendering, e.g. BigBlueButton. Background:...

CVE-2019-9849

CVE-2019-9849: Remote bullet graphics retrieved in “stealth mode” in LibreOffice LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable...

CVE-2023-2255

Command to execute the creation of the exploit: sudo python3 starkelevate.py /home/bob/Downloads/librecommand.exe --output librecommand.odt educational purposes only...

CVE-2023-36664

CVE-2023-36664 : Ghostscript 원격 코드 실행 CVE-2023-36664에 대한 개념 증명 코드입니다. 사용법 .eps 파일에 페이로드를 삽입하려면: root@kitploit: python3 poc.py -f "파일이름" --payload "명령어" python3 poc.py -f file.eps --payload firefox .eps 파일에 리버스 셸 페이로드를 삽입하려면: root@kitploit: python3 poc.py -f "파일이름" --revshell --ip "IP" --port "포트"...

CVE-2018-10583

CVE-2018-10583 An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious file, as demonstrated by "xlink:href=file://192.168.0.2/test.jpg" within an "office:document-content...

CVE-2018-10583

Updated python3 exploit for CVE-2018-10583 LibreOffice/Open Office - '.odt' Information Disclosure original credits to : https://www.exploit-db.com/exploits/44564 Usage 1. Install ezodf module with pip or pip3 2. Run the exploit with python3 it will generate a bad.odt file, upload it to the box 3...

libreofficeExploit1

익스플로잇 생성 기본 매뉴얼 이 글에서는 프로그램의 간단한 취약점을 이용하여 해당 프로그램을 사용하는 시스템에 백도어를 여는 방법을 설명합니다. 해당 취약점은 오피스 스위트 LibreOffice의 CVE-2018-16858에 정의되어 있습니다. 이 취약점은 특별히 구성된 파일에서 디렉토리 트래버설을 수행하여 Python 코드 실행을 허용합니다. 해당 실행은 문서에 대한 사용자의 동작마우스 오버 시 연결되거나 실행되며, 매크로 실행에 대한 어떠한 경고도 사용자에게 제공되지 않습니다. 본 문서는 다섯 부분으로 나뉩니다. 첫 번째...

libreoffice-remote-arbitrary-file-disclosure

Vulnerability description CVE-2018-6871 First part LibreOffice supports COM.MICROSOFT.WEBSERVICE function: root@kitploit: https://support.office.com/en-us/article/webservice-function-0546a35a-ecc6-4739-aed7-c0b7ce1562c4 The function is required to obtain data by URL, usually used as: root@kitploi...

HTB-Mailing-A-Complete-Walkthrough

HTB: Mailing — A Complete Walkthrough By Mursalin If you've been grinding through HackTheBox machines, Mailing is one of those boxes that genuinely teaches you something. It's rated Easy, runs on Windows, and chains together a few real-world vulnerabilities — a directory traversal, a credential...

Windows-Exploit-Suggester-Python3

Windows-Exploit-Suggester-Python3 python3 windows-exploit-suggester.py --update libreoffice --headless --convert-to xls 2021-07-15-mssb.xlsx python3 windows-exploit-suggester.py --database 2021-07-15-mssb.xls --systeminfo systeminfo.txt Example : so we should convert xlsx to xls...

CVE-2026-54732

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

NPM: libreoffice-convert vulnerable to path traversal / arbitrary file write

NPM: libreoffice-convert vulnerable to path traversal / arbitrary file write vulnerability discovered by ? in WordPress Npm libreoffice-convert versions 1.8.2...

@cluesurf/task (0.5.4), @tadashi/doc2pdf (>=1.1.0, <=1.1.3) potentially affected by CVE-2026-54732 via libreoffice-convert (>=1.6.1, <=1.8.1)

libreoffice-convert NPM version =1.6.1, =1.1.0, =1.1.3 Source cves: CVE-2026-54732 Source advisory: OSV:GHSA-GMXC-R82Q-347R...

libreoffice-convert vulnerable to path traversal / arbitrary file write

Impact options.fileName is used to build a filesystem path path.jointempDir.name, fileName and the caller-supplied document buffer is written there, but fileName is never reduced to a base name. A fileName containing "../" escapes the temporary directory, so a caller can write arbitrary content t...

GHSA-GMXC-R82Q-347R libreoffice-convert vulnerable to path traversal / arbitrary file write

Impact options.fileName is used to build a filesystem path path.jointempDir.name, fileName and the caller-supplied document buffer is written there, but fileName is never reduced to a base name. A fileName containing "../" escapes the temporary directory, so a caller can write arbitrary content t...

CVE-2026-54732 libreoffice-convert: path traversal / arbitrary file write

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

CVE-2026-54732 libreoffice-convert: path traversal / arbitrary file write

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

EUVD-2026-67161

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

CVE-2026-54732

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2 , the options.fileName value passed to path.join(tempDir.name, fileName) in index.js is never reduced to a base name. A filename containing ../ allows an attacker to escape the temporary d...