{"id":"CVE-2026-63267","aliases":["BELL-CVE-2026-63267","DEBIAN-CVE-2026-63267","EUVD-2026-92418","GHSA-2r33-w77m-6p5h","MGASA-2026-0514","UBUNTU-CVE-2026-63267"],"status":"published","title":"LFI and GET SSRF via calcext:data-mappings and csv provider","description":"LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions external data links are updated under the same link update control as other links in a spreadsheet.","severity":{"version":"4.0","score":6.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00112,"percentile":0.01371,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-918"],"published":"2026-10-05T11:17:22Z","modified":"2026-11-04T07:15:38Z","fixes":[{"ecosystem":"Alpaquita:23","package":"libreoffice-headless","fixed_in":["7.6.7.2-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libreoffice-headless","fixed_in":["25.2.5.2-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libreoffice-headless","fixed_in":["25.8.7.3-r5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libreoffice","fixed_in":["4:25.2.3-2+deb13u8"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libreoffice","fixed_in":["4:26.2.5.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:23","package":"libreoffice-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.6.3.2-r3"},{"fixed":"7.6.7.2-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libreoffice-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.2.3.2-r0"},{"fixed":"25.2.5.2-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libreoffice-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.6.4.1-r1"},{"fixed":"25.8.7.3-r5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:24.2.0-1","4:24.2.0-1~bpo12+1","4:24.2.0-2","4:24.2.0-3","4:24.2.0~alpha1-1","4:24.2.0~beta1-1","4:24.2.0~rc1-1","4:24.2.0~rc1-2","4:24.2.0~rc2-1","4:24.2.0~rc2-2","4:24.2.0~rc2-2~bpo12+1","4:24.2.1-1","4:24.2.1-2","4:24.2.1-3","4:24.2.1-4","4:24.2.1~rc1-1","4:24.2.1~rc2-1","4:24.2.2-1","4:24.2.2-2","4:24.2.2-3","4:24.2.2~rc1-1","4:24.2.2~rc1-2","4:24.2.2~rc2-1","4:24.2.2~rc2-2","4:24.2.3-1","4:24.2.3-1~bpo12+1","4:24.2.3-2","4:24.2.3~rc1-1","4:24.2.3~rc1-2","4:24.2.3~rc1-3","4:24.2.3~rc2-1","4:24.2.4-1","4:24.2.4-1~bpo12+1","4:24.2.5-1","4:24.2.5-1~bpo12+1","4:24.2.5-2","4:24.2.5-3","4:24.2.5-4","4:24.2.6-1","4:24.2.6-2","4:24.2.6-2~bpo12+1","4:24.8.0~alpha1-1","4:24.8.0~alpha1-2","4:24.8.0~alpha1-3","4:24.8.0~alpha1-4","4:24.8.0~beta1-1","4:24.8.0~rc1-1","4:24.8.0~rc2-1","4:24.8.0~rc3-1","4:24.8.0~rc3-2","4:24.8.1-1","4:24.8.1-2","4:24.8.1~rc1-1","4:24.8.2-1","4:24.8.2-1~bpo12+1","4:24.8.2-2","4:24.8.2~rc1-1","4:24.8.3-1","4:24.8.3-1~bpo12+1","4:24.8.3-2","4:24.8.3-3","4:24.8.4-1","4:24.8.4-1~bpo12+1","4:24.8.4-2","4:24.8.4-3","4:24.8.4-4","4:24.8.5-1","4:24.8.5-2","4:24.8.5-2~bpo12+1","4:24.8.5-2~bpo12+2","4:25.2.0~alpha1-1","4:25.2.0~beta1-1","4:25.2.0~beta1-2","4:25.2.0~rc1-1","4:25.2.0~rc1-2","4:25.2.0~rc1-3","4:25.2.0~rc1-4","4:25.2.0~rc2-1","4:25.2.0~rc3-1","4:25.2.0~rc3-2","4:25.2.1-1","4:25.2.1-2","4:25.2.1-3","4:25.2.1-3~bpo12+1","4:25.2.1~rc1-1","4:25.2.1~rc1-2","4:25.2.1~rc2-1","4:25.2.2-1","4:25.2.2-1~bpo12+1","4:25.2.2-2","4:25.2.2-3","4:25.2.2-3~bpo12+1","4:25.2.2~rc1-1","4:25.2.2~rc2-1","4:25.2.3-1","4:25.2.3-2","4:25.2.3-2~bpo12+1","4:25.2.3~rc1-1","4:25.2.3~rc1-2","4:25.2.3~rc2-1","4:25.8.0-1","4:25.8.0-1~bpo13+1","4:25.8.0~alpha1-1","4:25.8.0~alpha1-2","4:25.8.0~beta1-1","4:25.8.0~rc1-1","4:25.8.0~rc1-2","4:25.8.0~rc2-1","4:25.8.0~rc2-2","4:25.8.0~rc3-1","4:25.8.0~rc4-1","4:25.8.0~rc4-2","4:25.8.1-1","4:25.8.1-1~bpo13+1","4:25.8.1~rc1-1","4:25.8.2-1","4:25.8.2-2","4:25.8.2-3","4:25.8.2-3~bpo13+1","4:25.8.2~rc1-1","4:25.8.2~rc2-1","4:25.8.3-1","4:25.8.3-1+ports","4:25.8.3-1~bpo13+1","4:25.8.3~rc1-1","4:25.8.3~rc2-1","4:25.8.4-1","4:25.8.4-1~bpo13+1","4:26.2.0-1","4:26.2.0-1~bpo13+1","4:26.2.0~alpha1-1","4:26.2.0~alpha1-2","4:26.2.0~alpha1-3","4:26.2.0~beta1-1","4:26.2.0~rc1-1","4:26.2.0~rc2-1","4:26.2.0~rc3-1","4:26.2.1-1","4:26.2.1-1~bpo13+1","4:26.2.1~rc1-1","4:26.2.1~rc2-1","4:26.2.2.1-1","4:26.2.2.1-2","4:26.2.2.2-1","4:26.2.2.2-2","4:26.2.2.2-3","4:26.2.2.2-3~bpo13+1","4:26.2.3.1-1","4:26.2.3.2-1","4:26.2.3.2-2","4:26.2.3.2-2~bpo13+1","4:26.2.4.1-1","4:26.2.4.2-1","4:26.2.4.2-1~bpo13+1","4:26.2.4.2-2","4:26.2.5.2-1","4:26.2.5.2-2","4:26.2.5.2-2~bpo13+1","4:26.8.0.0.alpha1-1","4:26.8.0.0.alpha1-2","4:26.8.0.0.alpha1-3","4:26.8.0.0.alpha1-4","4:26.8.0.0.beta1-1","4:26.8.0.1-1","4:26.8.0.2-1","4:26.8.0.3-1","4:26.8.0.3-2","4:26.8.0.3-2~bpo13+1","4:26.8.1.1-1","4:26.8.1.1-2","4:26.8.1.1-3","4:7.4.5-3","4:7.4.7-1","4:7.4.7-1+deb12u1","4:7.4.7-1+deb12u10","4:7.4.7-1+deb12u11","4:7.4.7-1+deb12u12","4:7.4.7-1+deb12u13","4:7.4.7-1+deb12u14","4:7.4.7-1+deb12u1~bpo11+1","4:7.4.7-1+deb12u2","4:7.4.7-1+deb12u2~bpo11+1","4:7.4.7-1+deb12u3","4:7.4.7-1+deb12u4","4:7.4.7-1+deb12u5","4:7.4.7-1+deb12u6","4:7.4.7-1+deb12u7","4:7.4.7-1+deb12u8","4:7.4.7-1+deb12u9","4:7.4.7-1~bpo11+1","4:7.5.0~rc2-7","4:7.5.0~rc3-1","4:7.5.1~rc1-1","4:7.5.1~rc2-1","4:7.5.2~rc1-1","4:7.5.2~rc2-1","4:7.5.3~rc1-1","4:7.5.3~rc2-1","4:7.5.4-1","4:7.5.4-2","4:7.5.4-3","4:7.5.4-4","4:7.5.4~rc1-1","4:7.5.4~rc1-2","4:7.5.4~rc1-3","4:7.5.4~rc1-4","4:7.5.4~rc2-1","4:7.5.5-1","4:7.5.5-2","4:7.5.5-3","4:7.5.5-3~bpo12+1","4:7.5.5-4","4:7.5.5-4~bpo12+1","4:7.5.5~rc1-1","4:7.5.5~rc1-2","4:7.5.5~rc1-3","4:7.5.5~rc1-4","4:7.5.5~rc1-5","4:7.5.5~rc2-1","4:7.5.6-1","4:7.5.6-1~bpo12+1","4:7.5.7-1","4:7.5.8-1","4:7.5.8-1~bpo12+1","4:7.5.8~rc1-1","4:7.5.8~rc1-2","4:7.5.9~rc1-1","4:7.5.9~rc1-1~bpo12+1","4:7.5.9~rc1-1~bpo12+2","4:7.6.0~rc1-1","4:7.6.0~rc1-2","4:7.6.0~rc2-1","4:7.6.0~rc2-2","4:7.6.0~rc3-1","4:7.6.1~rc1-1","4:7.6.1~rc2-1","4:7.6.1~rc2-2","4:7.6.2-1","4:7.6.2-2","4:7.6.2-3","4:7.6.2-4","4:7.6.2-5","4:7.6.3-1","4:7.6.3-2","4:7.6.3~rc1-1","4:7.6.3~rc1-2","4:7.6.3~rc2-1","4:7.6.3~rc2-2","4:7.6.4~rc1-1","4:7.6.4~rc1-1~bpo12+1"]},{"source":"osv","ecosystem":"Debian:13","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:25.2.3-2+deb13u8"}]}],"versions":["4:25.2.3-2","4:25.2.3-2+deb13u1","4:25.2.3-2+deb13u2","4:25.2.3-2+deb13u2~bpo12+1","4:25.2.3-2+deb13u3","4:25.2.3-2+deb13u3~bpo12+1","4:25.2.3-2+deb13u4","4:25.2.3-2+deb13u5","4:25.2.3-2+deb13u5~bpo12+1","4:25.2.3-2+deb13u6","4:25.2.3-2+deb13u7"]},{"source":"osv","ecosystem":"Debian:14","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:26.2.5.2-1"}]}],"versions":["4:25.2.3-2","4:25.8.0-1","4:25.8.0-1~bpo13+1","4:25.8.0~alpha1-1","4:25.8.0~alpha1-2","4:25.8.0~beta1-1","4:25.8.0~rc1-1","4:25.8.0~rc1-2","4:25.8.0~rc2-1","4:25.8.0~rc2-2","4:25.8.0~rc3-1","4:25.8.0~rc4-1","4:25.8.0~rc4-2","4:25.8.1-1","4:25.8.1-1~bpo13+1","4:25.8.1~rc1-1","4:25.8.2-1","4:25.8.2-2","4:25.8.2-3","4:25.8.2-3~bpo13+1","4:25.8.2~rc1-1","4:25.8.2~rc2-1","4:25.8.3-1","4:25.8.3-1+ports","4:25.8.3-1~bpo13+1","4:25.8.3~rc1-1","4:25.8.3~rc2-1","4:25.8.4-1","4:25.8.4-1~bpo13+1","4:26.2.0-1","4:26.2.0-1~bpo13+1","4:26.2.0~alpha1-1","4:26.2.0~alpha1-2","4:26.2.0~alpha1-3","4:26.2.0~beta1-1","4:26.2.0~rc1-1","4:26.2.0~rc2-1","4:26.2.0~rc3-1","4:26.2.1-1","4:26.2.1-1~bpo13+1","4:26.2.1~rc1-1","4:26.2.1~rc2-1","4:26.2.2.1-1","4:26.2.2.1-2","4:26.2.2.2-1","4:26.2.2.2-2","4:26.2.2.2-3","4:26.2.2.2-3~bpo13+1","4:26.2.3.1-1","4:26.2.3.2-1","4:26.2.3.2-2","4:26.2.3.2-2~bpo13+1","4:26.2.4.1-1","4:26.2.4.2-1","4:26.2.4.2-1~bpo13+1","4:26.2.4.2-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.6.3-1.mga10"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:6.3.2-0ubuntu2","1:6.3.3-0ubuntu1","1:6.3.3-0ubuntu2","1:6.3.4-0ubuntu1","1:6.4.0-0ubuntu4","1:6.4.0-0ubuntu6","1:6.4.0-0ubuntu7","1:6.4.1-0ubuntu1","1:6.4.2-0ubuntu1","1:6.4.2-0ubuntu2","1:6.4.2-0ubuntu3","1:6.4.3-0ubuntu0.20.04.1","1:6.4.4-0ubuntu0.20.04.1","1:6.4.5-0ubuntu0.20.04.1","1:6.4.6-0ubuntu0.20.04.1","1:6.4.7-0ubuntu0.20.04.1","1:6.4.7-0ubuntu0.20.04.2","1:6.4.7-0ubuntu0.20.04.4","1:6.4.7-0ubuntu0.20.04.5","1:6.4.7-0ubuntu0.20.04.6","1:6.4.7-0ubuntu0.20.04.7","1:6.4.7-0ubuntu0.20.04.8","1:6.4.7-0ubuntu0.20.04.9","1:6.4.7-0ubuntu0.20.04.10","1:6.4.7-0ubuntu0.20.04.11","1:6.4.7-0ubuntu0.20.04.12","1:6.4.7-0ubuntu0.20.04.13","1:6.4.7-0ubuntu0.20.04.14","1:6.4.7-0ubuntu0.20.04.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.2.1-0ubuntu3","1:7.2.2-0ubuntu0.21.10.1","1:7.2.3~rc2-0ubuntu1","1:7.2.4-0ubuntu1","1:7.2.5~rc1-0ubuntu2","1:7.2.5~rc2-0ubuntu1","1:7.3.1~rc2-0ubuntu1","1:7.3.1~rc3-0ubuntu1","1:7.3.2~rc1-0ubuntu2","1:7.3.2~rc2-0ubuntu1","1:7.3.2-0ubuntu1","1:7.3.2-0ubuntu2","1:7.3.3-0ubuntu0.22.04.1","1:7.3.4-0ubuntu0.22.04.1","1:7.3.5-0ubuntu0.22.04.1","1:7.3.6-0ubuntu0.22.04.1","1:7.3.6-0ubuntu0.22.04.2","1:7.3.7-0ubuntu0.22.04.1","1:7.3.7-0ubuntu0.22.04.2","1:7.3.7-0ubuntu0.22.04.3","1:7.3.7-0ubuntu0.22.04.4","1:7.3.7-0ubuntu0.22.04.5","1:7.3.7-0ubuntu0.22.04.6","1:7.3.7-0ubuntu0.22.04.7","1:7.3.7-0ubuntu0.22.04.8","1:7.3.7-0ubuntu0.22.04.9","1:7.3.7-0ubuntu0.22.04.10","1:7.3.7-0ubuntu0.22.04.11","1:7.3.7-0ubuntu0.22.04.12","1:7.3.7-0ubuntu0.22.04.13"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:7.6.2-0ubuntu1","4:7.6.3~rc1-0ubuntu2","4:7.6.3-0ubuntu3","4:7.6.4-0ubuntu1","4:7.6.4-0ubuntu3","4:24.2.0~rc1-0ubuntu1","4:24.2.1~rc1-0ubuntu1","4:24.2.1~rc2-0ubuntu1","4:24.2.2~rc2-0ubuntu1","4:24.2.2-0ubuntu1","4:24.2.3-0ubuntu0.24.04.1","4:24.2.3-0ubuntu0.24.04.2","4:24.2.4-0ubuntu0.24.04.1","4:24.2.4-0ubuntu0.24.04.2","4:24.2.5-0ubuntu0.24.04.1","4:24.2.5-0ubuntu0.24.04.2","4:24.2.6-0ubuntu0.24.04.1","4:24.2.7-0ubuntu0.24.04.1","4:24.2.7-0ubuntu0.24.04.2","4:24.2.7-0ubuntu0.24.04.3","4:24.2.7-0ubuntu0.24.04.4","4:24.2.7-0ubuntu0.24.04.5","4:24.2.7-0ubuntu0.24.04.6","4:24.2.7-0ubuntu0.24.04.7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:26.2.2.2-0ubuntu1","4:26.2.4.2-0ubuntu1","4:26.2.5.1-0ubuntu1","4:26.2.5.2-0ubuntu3","4:26.8.0.3-0ubuntu1","4:26.8.1.1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:25.8.1~rc1-0ubuntu1","4:25.8.3-0ubuntu1","4:25.8.4~rc1-0ubuntu2","4:25.8.4~rc1-0ubuntu3","4:25.8.4~rc2-0ubuntu1","4:26.2.1~rc2-0ubuntu1","4:26.2.2.2-0ubuntu1","4:26.2.3.2-0ubuntu0.26.04.1","4:26.2.4.2-0ubuntu0.26.04.1","4:26.2.4.2-0ubuntu0.26.04.2","4:26.2.5.2-0ubuntu0.26.04.1","4:26.2.6.3-0ubuntu0.26.04.2"]}],"products":[{"vendor":"the document foundation","product":"libreoffice"}],"references":[{"url":"https://www.libreoffice.org/about-us/security/advisories/cve-2026-63267"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63267"},{"url":"https://github.com/advisories/GHSA-2r33-w77m-6p5h"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-63267","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-63267","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0514.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36383","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00424.html","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63272","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63273","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63274","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63275","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63276","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63277","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63278","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63279","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00457.html","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63266","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63267","tags":["web","report"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63268","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63269","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63270","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8868-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-63267","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63267","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-63267","title":"LFI and GET SSRF via calcext:data-mappings and csv provider","description":"LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions external data links are updated under the same link update control as other links in a spreadsheet.","status":"published","published":"2026-10-05T11:17:22.209Z","modified":"2026-10-05T12:42:18.571Z","cvss":[{"version":"4.0","score":6.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-918","CWE-200"],"updated_at":"2026-11-02T14:19:55.914391Z"}],"euvd":[{"id":"EUVD-2026-92418","description":"LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions external data links are updated under the same link update control as other links in a spreadsheet.","status":"published","published":"2026-10-05T11:17:22Z","modified":"2026-10-05T12:42:18Z","cvss":[{"version":"4.0","score":6.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:40.198021Z"}],"ghsa":[{"id":"GHSA-2r33-w77m-6p5h","title":"LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in...","description":"LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions external data links are updated under the same link update control as other links in a spreadsheet.","status":"published","published":"2026-10-05T12:31:27Z","modified":"2026-10-05T12:31:34Z","cvss":[{"version":"4.0","score":6.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:12:48.068686Z"}],"nvd":[{"id":"CVE-2026-63267","description":"LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions external data links are updated under the same link update control as other links in a spreadsheet.","status":"published","published":"2026-10-05T12:17:10.713Z","modified":"2026-10-06T15:03:59.427Z","cvss":[{"version":"4.0","score":6.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-200","CWE-918"],"updated_at":"2026-11-02T14:12:53.75133Z"}],"osv":[{"id":"DEBIAN-CVE-2026-63267","description":"LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions external data links are updated under the same link update control as other links in a spreadsheet.","status":"published","published":"2026-10-05T12:17:10.713Z","modified":"2026-10-07T09:47:31.520644998Z","cvss":[{"version":"4.0","score":6.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"UBUNTU-CVE-2026-63267","description":"LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions external data links are updated under the same link update control as other links in a spreadsheet.","status":"published","published":"2026-10-05T12:17:00Z","modified":"2026-10-17T12:59:16.02978079Z","cvss":[{"version":"4.0","score":6.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:43.630667Z"},{"id":"BELL-CVE-2026-63267","status":"published","published":"2026-10-06T06:05:21.63996Z","modified":"2026-11-04T07:15:38.378195085Z","updated_at":"2026-11-04T07:32:10.855619Z"},{"id":"MGASA-2026-0514","title":"Updated libreoffice package fixes security vulnerabilities","description":"Arbitrary file write via calcext:data-mappings, sql provider and\nFirebird backup functionality. (CVE-2026-63266)\nLFI and GET SSRF via calcext:data-mappings and csv provider.\n(CVE-2026-63267)\nLFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db\nhref. (CVE-2026-63268)\nLFI and GET SSRF via GStreamer and HLS playlists. (CVE-2026-63269)\nEnvironment/ini-file leaks. (CVE-2026-63270)\nHeap buffer overflow in WMF text record import. (CVE-2026-63272)\nHeap buffer overflow in PDF import encryption handling. (CVE-2026-63273)\nHeap buffer overflow in PDF import stream handling. (CVE-2026-63274)\nStack buffer overflow in CFF font hint handling. (CVE-2026-63275)\nStack buffer overflow in CFF to Type 1 font conversion. (CVE-2026-63276)\nRCE via calcext:data-mappings, sql provider and jdbc connector.\n(CVE-2026-63277)\nPackage URLs can be used to exfiltrate arbitrary INI file values and\nenvironment variables. (CVE-2026-63278)\nOut of bounds read in PICT image import. (CVE-2026-63279)\n","status":"published","published":"2026-10-17T03:21:49Z","modified":"2026-10-17T03:30:03.784898295Z","updated_at":"2026-11-02T15:49:43.795591Z"}]}}