Vulnerability · Published Oct 5, 2026 · Assigned by Document Fdn.
CVE-2026-63266Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality
Medium 6.8
In plain English
A medium-severity path traversal in LibreOffice from The Document Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or create files only inside its own private directory.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libreoffice | no fix listed | DEBIAN-CVE-2026-63266 |
| Debian:13 | libreoffice | 4:25.2.3-2+deb13u8 | DEBIAN-CVE-2026-63266 |
| Debian:14 | libreoffice | 4:26.2.5.2-1 | DEBIAN-CVE-2026-63266 |
| Ubuntu:22.04:LTS | libreoffice | no fix listed | UBUNTU-CVE-2026-63266 |
| Ubuntu:24.04:LTS | libreoffice | no fix listed | UBUNTU-CVE-2026-63266 |
| Ubuntu:26.04:LTS | libreoffice | no fix listed | UBUNTU-CVE-2026-63266 |
| Ubuntu:26.10 | libreoffice | no fix listed | UBUNTU-CVE-2026-63266 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The Document Foundation | LibreOffice | 26.2 – before < 26.2.5 |
Weakness: CWE-22 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N