CVE-2026-63266: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in The Document Foundation LibreOffice

LibreOffice Calc allows linking a cell range to an external data source, which is saved in the document. This functionality could be exploited to cause an embedded Firebird database to write files to any location the user has write permissions for, due to improper limitation of pathname to a restricted directory (CWE-22). The vulnerability is addressed in fixed versions by restricting the embedded Firebird database to open or create files only inside its own private directory.

An attacker could leverage this vulnerability to write files to arbitrary locations accessible by the user, potentially leading to unauthorized file creation or modification within the user's writable directories. The CVSS 4.0 score is 6.8 (medium severity), indicating a locally exploitable issue requiring user interaction but with no privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description notes that fixed versions restrict file operations of the embedded Firebird database to its private directory, implying a fix exists or is planned. Until official patches or updates are available, users should exercise caution when opening documents with external data links.