CVE-2026-63268: LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml data providers are restored when a document is loaded.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who open LibreOffice Calc documents from untrusted sources are exposed if those documents contain a saved external data link using the SQL provider and a local flat-file database path.
What does exploitation require?
An attacker needs to provide a Calc document containing a stored calcext:data-mappings link of type SQL that names a local folder of text files through an sdbc:flat:file:// database href. The issue is triggered when the document is opened.
What information could be exposed?
The vulnerable behavior can read a local text file and import its contents into the spreadsheet. The available information does not specify which local files or paths can be read.
How can I tell whether a document is suspicious?
Inspect the document for saved external data mappings that use an SQL data provider and an sdbc:flat:file:// database href. Such links may point to a local folder of text files.
What changes in fixed versions?
When loading a document, fixed versions restore only CSV, HTML, and XML data providers. SQL data-provider links are not restored.