CVE-2026-63268: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in The Document Foundation LibreOffice

LibreOffice Calc allows linking a cell range to an external data source, and this link is saved within the document. If the link is of the sql type and references a folder of local text files as a database, opening the document can cause local text files to be read into the spreadsheet. This behavior exposes sensitive local information to unauthorized actors. The issue is addressed in fixed versions by restoring only csv, html, and xml data providers when loading documents, thereby preventing arbitrary local file reading via sql-type links.

An attacker could craft a malicious LibreOffice document that, when opened, reads local text files into the spreadsheet, potentially exposing sensitive information stored on the local system. This exposure occurs without explicit user consent and requires only limited privileges and user interaction (opening the document). The vulnerability does not involve privilege escalation or remote code execution but can lead to unauthorized disclosure of local data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor advisory notes that fixed versions restore only csv, html, and xml data providers when loading documents, which mitigates the vulnerability. Until a patch is confirmed, users should exercise caution when opening untrusted LibreOffice documents, especially those containing external data links.