CVE-2026-63270

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description Opening a document containing specially crafted links allows the construction of URLs that expand environment variable or INI file values. This can lead to the exfiltration of sensitive information to a remote server. The issue persists in XForms instance data and the Calc csv and sql data providers, which still allow the expansion of URLs with internal schemes when supplied by a document.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.