CVE-2026-63270: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in The Document Foundation LibreOffice

This vulnerability involves the exposure of sensitive information through URLs in LibreOffice documents. Specifically, URLs could be crafted to expand environment variables or INI file values, potentially leaking sensitive data to remote servers when such documents are opened. The prior fix for CVE-2024-12426 did not cover all document locations where URLs could be supplied, such as XForms instance data and Calc csv and sql data providers. In the fixed versions, these locations refuse URLs with internal schemes if the URL originates from the document, mitigating the risk of information exposure.

An attacker could craft a document containing specially constructed URLs that, when opened, cause LibreOffice to expand environment variables or INI file values and send potentially sensitive information to a remote server. This leads to unauthorized disclosure of sensitive data. The vulnerability requires at least limited privileges (local access with low privileges) and user interaction to open the malicious document. The CVSS 4.0 score of 6.7 reflects a medium severity impact with high confidentiality impact but no integrity or availability impact.

No explicit patch or remediation link is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid opening documents from untrusted sources that may contain crafted URLs. Once a vendor fix is released, updating to the fixed version is recommended to prevent URL expansion from document sources that could leak sensitive information.