CVE-2026-90627: Apache OpenOffice: Local file inclusion via SQL provider and flat file database references
The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the contents of any local file without asking the user. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache OpenOfficeto a version that resolves this vulnerability.Fixed in 4.1.17
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Apache OpenOffice versions through 4.1.16 are affected when they open a crafted document. Exploitation is local and requires user interaction.
What can an attacker access?
A crafted document can use the flat file database driver to read the contents of any local file without prompting the user. The provided information does not indicate integrity or availability impact.
What is the recommended remediation?
Upgrade Apache OpenOffice to version 4.1.17, which fixes the issue.