PT-2026-104816

CVE-2026-63269

Published

2026-10-05

Updated

2026-10-17

Description by

CVSS 4.0

6.7

Medium

MetricsAV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LibreOffice (affected versions not specified)

Description On Linux, the software uses GStreamer to play audio and video files linked within a document. A linked media file formatted as an HLS (HTTP Live Streaming) playlist—a protocol for streaming audio and video over HTTP—can force GStreamer to read local files and remote URLs during the document loading process. This can result in the contents of those local files or remote resources being incorporated into the document, leading to Local File Inclusion (LFI) and Server-Side Request Forgery (SSRF).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Impacts

Researchers

Caolán Mcnamara

Vendors

Affected products

Weakness enumeration

CWE-918: Server-Side Request Forgery (SSRF)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers

CVE-2026-63269

ECHO-8539-27B6-DD9F