CVE-2026-63266 — Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database…
Published: 2026-10-05 · CVSS: 6.8 · CVSS 4.0
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or create files only inside its own private directory.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7