CVE-2026-63268 LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href
An attacker can read local text files into a spreadsheet by crafting a document with a malicious SQL data link, exposing sensitive local data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-63268?
CVE-2026-63268 is a medium-severity path traversal vulnerability in The Document Foundation LibreOffice, published on 5 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml data providers are restored when a document is loaded.
Weakness: CWE-200
Which versions are affected by CVE-2026-63268?
How do I fix CVE-2026-63268?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-63268 being exploited?
There is no known exploitation of CVE-2026-63268 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-63268, DEBIAN-CVE-2026-63268, ECHO-9bb6-16d7-0730, GHSA-rvj5-mfwr-769g, MINI-pw8m-g9qw-525q, UBUNTU-CVE-2026-63268.