MEDIUM 6.7 NVD

CVE-2026-63278

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server o

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content provider, so a URL that named it differently still reached the expansion. In fixed versions the package content provider is matched when the URL is checked.

References

https://www.libreoffice.org/about-us/security/advisories/cve-2026-63278

Published: 2026-09-22 · Source: NVD · Feed updated: 2026-09-22

This medium severity vulnerability with a CVSS score of 6.7 was published on 2026-09-22 via NVD.

vulnfeed aggregates 14151 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.