CVE-2025-27791
Collabora Online Vulnerable to Arbitrary File Write
- State
- Published
- Severity
- 8.3 High
- Published
- Apr 15, 2025
- Updated
- Apr 15, 2025
- Reserved
- Mar 6, 2025
Description
Collabora Online is a collaborative online office suite based on LibreOffice technology. In versions prior to 24.04.12.4, 23.05.19, and 22.05.25, there is a path traversal flaw in handling the CheckFileInfo BaseFileName field returned from WOPI servers. This allows for a file to be written anywhere the uid running Collabora Online can write, if such a response was supplied by a malicious WOPI server. By combining this flaw with a Time of Check, Time of Use DNS lookup issue with a WOPI server address under attacker control, it is possible to present such a response to be processed by a Collabora Online instance. This issue has been patched in versions 24.04.13.1, 23.05.19, and 22.05.25.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.3 High | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N | GitHub_M |
Weaknesses
- CWE-23 Relative Path Traversal
Affected Products
| Product | Versions |
|---|---|
onlineCollaboraOnline |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.