CVE-2026-63268

A flaw was found in LibreOffice Calc. An attacker could craft a spreadsheet document with an external database link that points to local text files. If a user opens the malicious document, the application automatically reads the local file contents into the sheet, leading to unauthorized information disclosure.

A flaw was found in LibreOffice Calc, where opening a document with an external database link using sql-type providers allows automatic local text file ingestion into the spreadsheet. An attacker can exploit this by crafting a malicious spreadsheet that references local files, leading to unauthorized local file disclosure upon opening under the user's execution context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable or restrict external data link updates in LibreOffice Calc by setting Macro Security and Link Security options to "Never update links" or explicitly requiring user confirmation before restoring untrusted external data links.