CVE-2026-63270
Received Received - Intake

Environment Variable Expansion in LibreOffice via Document Links

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: Document Foundation, The

Description
URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every place a document can supply a URL. XForms instance data and the Calc csv and sql data providers still reached the expansion. In fixed versions these places refuse URLs with internal schemes when the URL comes from the document.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-05
Last Modified
2026-10-05
Generated
2026-10-05
AI Q&A
2026-10-05
EPSS Evaluated
N/A
NVD
CVE-2026-63270
EUVD
EUVD-2026-92421

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
The Document Foundation LibreOffice 26.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows URLs in documents to expand environment variables or INI file values, potentially leaking sensitive information to remote servers. The issue was not fully addressed in a previous fix (CVE-2024-12426) as some document-provided URLs, like those in XForms instance data or Calc CSV/SQL data providers, still allowed such expansions.

Detection Guidance

This vulnerability involves URL expansion that could leak sensitive information. Detection requires checking LibreOffice documents for URLs with internal schemes. Inspect document properties and links for suspicious URLs. No specific commands are provided in the context.

Impact Analysis

An attacker could craft a document containing malicious URLs that exfiltrate sensitive data from your system when opened. This includes environment variables or configuration file contents, which may contain passwords, API keys, or other confidential information.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations may face compliance violations if sensitive data is leaked due to this issue.

Mitigation Strategies

Update LibreOffice to a fixed version where URLs with internal schemes from documents are refused. Avoid opening documents from untrusted sources until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63270. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart