CVE-2026-63269: CWE-918 Server-Side Request Forgery (SSRF) in The Document Foundation LibreOffice

LibreOffice 26.2 on Linux uses GStreamer to play linked audio and video files in documents. When a linked media file is an HLS playlist, GStreamer may read local files and remote URLs listed in the playlist during document loading. This behavior can lead to server-side request forgery (CWE-918) and unintended information disclosure (CWE-200) as the contents of these resources could be incorporated into the document. The vulnerability is mitigated in fixed versions by preventing LibreOffice from following playlists that name further resources and by enforcing control over linked media updates.

An attacker can exploit this vulnerability to cause LibreOffice to access local and remote resources specified in an HLS playlist, potentially leading to unauthorized disclosure of local file contents or remote data. This could compromise confidentiality by exposing sensitive information within the document. The CVSS 4.0 score of 6.7 (medium severity) reflects the local attack vector, low complexity, and partial impact on confidentiality with no impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description notes that fixed versions prevent following playlists that reference further resources and control linked media updates. Users should monitor The Document Foundation advisories for official patches or updates addressing this issue. Until then, avoid opening untrusted documents containing linked media files, especially on Linux systems using GStreamer.