CVE-2026-63267: LFI and GET SSRF via calcext:data-mappings and csv provider
LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions external data links are updated under the same link update control as other links in a spreadsheet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure external data links, including links created through calcext:data-mappings and the CSV provider, to be updated under the same link update control as other links in the spreadsheet.
LibreOffice Calc external data link updates = use the same link update control as other spreadsheet links
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must provide a Calc document containing a calcext:data-mappings link to an external CSV data source and convince a user to open it. On document load, the link could read a local file into the sheet or send a request to an attacker-selected host.
Who is exposed?
Users who open untrusted LibreOffice Calc documents are exposed, because the external data link was fetched while the document loaded. Systems where Calc can access sensitive local files or reach internal network resources may face greater impact.
What changes in fixed versions?
Fixed versions place external data-link updates under the same link-update control used for other spreadsheet links. This prevents these CSV data links from being fetched automatically outside that control.