CVE-2026-63268 — LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a dat…
Published: 2026-10-05 · CVSS: 6.7 · CVSS 4.0
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml data providers are restored when a document is loaded.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7