CVE-2026-63267: CWE-918 Server-Side Request Forgery (SSRF) in The Document Foundation LibreOffice

LibreOffice Calc version 26.2 contains a server-side request forgery vulnerability (CWE-918) where a cell range linked to an external CSV data source is fetched automatically when the document loads. This behavior allows an attacker to craft a document that causes the application to read local files or make network requests to hosts chosen by the attacker. The vulnerability is mitigated in fixed versions by controlling external data link updates under the same mechanism as other spreadsheet links, preventing automatic fetching without user consent.

An attacker can exploit this vulnerability by embedding a specially crafted external CSV data link in a LibreOffice Calc document. When the document is opened, the application may fetch data from local files or arbitrary network hosts without explicit user approval, potentially leading to unauthorized data disclosure. The CVSS 4.0 score of 6.7 (medium severity) reflects the local attack vector with low complexity and partial confidentiality impact.

No explicit patch or fixed version is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid opening untrusted documents containing external data links until an official fix is released. Once fixed versions are available, update LibreOffice to versions where external data links are controlled under the same update mechanism as other links in spreadsheets.