CVE-2026-63267 LFI and GET SSRF via calcext:data-mappings and csv provider
Opening a malicious LibreOffice Calc document can trigger Server-Side Request Forgery and Local File Inclusion, allowing attackers to read local files or access internal network resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-63267?
CVE-2026-63267 is a medium-severity server-side request forgery vulnerability in The Document Foundation LibreOffice, published on 5 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions external data links are updated under the same link update control as other links in a spreadsheet.
Which versions are affected by CVE-2026-63267?
How do I fix CVE-2026-63267?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-63267 being exploited?
There is no known exploitation of CVE-2026-63267 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-63267, DEBIAN-CVE-2026-63267, ECHO-8cc6-8bbf-8126, GHSA-2r33-w77m-6p5h, MINI-9q2c-v4vj-4w63, UBUNTU-CVE-2026-63267.