Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN972 _____________________________________________________________________ DATE : 06/10/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running LibreOffice versions prior to 26.2.5, 26.2.5. ==================================================================== https://www.libreoffice.org/security/ _____________________________________________________________________ Addressed in LibreOffice 26.2.5/26.8.0 CVE-2026-63266 Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality Announced: Oct 5, 2026 Fixed in: LibreOffice 26.2.5/26.8.0 Description: LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or create files only inside its own private directory. All users are recommended to upgrade to LibreOffice >= 26.2.5 or >= 26.8.0 to avoid this problem. Credits: Thanks to Thomas Rinsma and Edoardo Geraci from Codean Labs for reporting this issue. Thanks to Caolán McNamara of Collabora Productivity for providing the fix. References: CVE-2026-63266 CVE-2026-63267 LFI and GET SSRF via calcext:data-mappings and csv provider Announced: Oct 5, 2026 Fixed in: LibreOffice 26.2.5/26.8.0 Description: LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document’s choosing. In fixed versions external data links are updated under the same link update control as other links in a spreadsheet. All users are recommended to upgrade to LibreOffice >= 26.2.5 or >= 26.8.0 to avoid this problem. Credits: Thanks to Thomas Rinsma and Edoardo Geraci from Codean Labs for reporting this issue. Thanks to Caolán McNamara of Collabora Productivity for providing the fix. References: CVE-2026-63267 CVE-2026-63268 LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href Announced: Oct 5, 2026 Fixed in: LibreOffice 26.2.5/26.8.0 Description: LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml data providers are restored when a document is loaded. All users are recommended to upgrade to LibreOffice >= 26.2.5 or >= 26.8.0 to avoid this problem. Credits: Thanks to Thomas Rinsma and Edoardo Geraci from Codean Labs for reporting this issue. Thanks to Caolán McNamara of Collabora Productivity for providing the fix. References: CVE-2026-63268 CVE-2026-63269 LFI and GET SSRF via GStreamer and HLS playlists Announced: Oct 5, 2026 Fixed in: LibreOffice 26.2.5/26.8.0 Description: LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control. All users are recommended to upgrade to LibreOffice >= 26.2.5 or >= 26.8.0 to avoid this problem. Credits: Thanks to Thomas Rinsma and Edoardo Geraci from Codean Labs for reporting this issue. Thanks to Caolán McNamara of Collabora Productivity for providing the fix. References: CVE-2026-63269 CVE-2026-63270 Environment/ini-file leaks Announced: Oct 5, 2026 Fixed in: LibreOffice 26.2.5/26.8.0 Description: URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every place a document can supply a URL. XForms instance data and the Calc csv and sql data providers still reached the expansion. In fixed versions these places refuse URLs with internal schemes when the URL comes from the document. All users are recommended to upgrade to LibreOffice >= 26.2.5 or >= 26.8.0 to avoid this problem. Credits: Thanks to Thomas Rinsma and Edoardo Geraci from Codean Labs for reporting this issue. Thanks to Caolán McNamara of Collabora Productivity for providing the fix. References: CVE-2026-63270 CVE-2026-63277 RCE via calcext:data-mappings, sql provider and jdbc connector Announced: Oct 5, 2026 Fixed in: LibreOffice 26.2.5/26.8.0 Description: LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in a Java class path has to be a file URL. All users are recommended to upgrade to LibreOffice >= 26.2.5 or >= 26.8.0 to avoid this problem. Credits: Thanks to Rick de Jager of the V12 security team, and to Thomas Rinsma and Edoardo Geraci from Codean Labs, for independently reporting this issue. Thanks to Caolán McNamara of Collabora Productivity for providing the fix. References: CVE-2026-63277 ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================