CVE-2026-63270

A flaw was found in LibreOffice. This vulnerability allows information disclosure when a user opens a specially crafted document. An attacker can construct malicious URLs within document features that expand local environment variables or configuration settings, enabling the exfiltration of sensitive system information to an external server.

A flaw was found in LibreOffice where certain document features, including XForms instance data and Calc CSV/SQL data providers, improperly process document-supplied URLs containing internal schemes. An attacker can exploit this by enticing a user to open a crafted document with constructed URLs that expand local environment variables or configuration values. When evaluated, these expanded values can be exfiltrated to a remote server under the executing user's privileges, leading to sensitive information disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Refrain from opening untrusted LibreOffice documents that reference external data sources or remote URLs. Do not enable automatic external link or data updates when loading documents from unknown origins.