Vulnerability · Published Oct 5, 2026 · Assigned by Document Fdn.
CVE-2026-63267LFI and GET SSRF via calcext:data-mappings and csv provider
Medium 6.7
In plain English
A medium-severity server-side request forgery in LibreOffice from The Document Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions external data links are updated under the same link update control as other links in a spreadsheet.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libreoffice | no fix listed | DEBIAN-CVE-2026-63267 |
| Debian:13 | libreoffice | 4:25.2.3-2+deb13u8 | DEBIAN-CVE-2026-63267 |
| Debian:14 | libreoffice | 4:26.2.5.2-1 | DEBIAN-CVE-2026-63267 |
| Ubuntu:22.04:LTS | libreoffice | no fix listed | UBUNTU-CVE-2026-63267 |
| Ubuntu:24.04:LTS | libreoffice | no fix listed | UBUNTU-CVE-2026-63267 |
| Ubuntu:26.04:LTS | libreoffice | no fix listed | UBUNTU-CVE-2026-63267 |
| Ubuntu:26.10 | libreoffice | no fix listed | UBUNTU-CVE-2026-63267 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The Document Foundation | LibreOffice | 26.2 – before < 26.2.5 |
Weakness: CWE-918, CWE-200 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N