CVE-2026-48164: Collabora Online: Reflected HTML injection through host_session_id
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the hostsessionid query/form parameter is substituted into the cool.html editor page without HTML encoding, unlike parameters passed through the existing variable-encoding mechanism. An attacker who induces a victim to load a crafted URL can inject HTML and, in the absence of an effective Content Security Policy, execute scripts in the Collabora Online iframe's origin, exposing the session authentication token and page contents. A reverse proxy that preserves the Content Security Policy header sent by coolwsd mitigates the script-execution scenario. This issue is fixed in versions 24.04.18 and 25.04.11.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Collabora Onlineto a version that resolves this vulnerability.Fixed in 24.04.18 - Upgrade
Upgrade
Collabora Onlineto a version that resolves this vulnerability.Fixed in 25.04.11 - Compensating control
Configure the reverse proxy to preserve the Content Security Policy header sent by coolwsd.
Event History
Frequently Asked Questions
Who is exposed to script execution through this issue?
Users who can be induced to load an attacker-crafted URL are exposed when Collabora Online is running a version before 24.04.18 or 25.04.11 and the Collabora Online iframe lacks an effective Content Security Policy.
What does an attacker need to exploit the vulnerability?
The attacker does not need privileges, but must persuade a victim to load a crafted URL containing a malicious host_session_id parameter. Successful script execution additionally depends on the absence of an effective Content Security Policy.
What is the impact if exploitation succeeds?
Injected scripts can run in the origin of the Collabora Online iframe. This can expose the victim's session authentication token and the contents of the page.
What can be done if upgrading is not immediately possible?
Ensure that the reverse proxy preserves the Content Security Policy header sent by coolwsd. Preserving this header mitigates the script-execution scenario.