CVE-2026-63269

LFI and GET SSRF via GStreamer and HLS playlists

State: Published
Severity: 6.7 Medium
Published: Oct 5, 2026
Updated: Oct 5, 2026
Reserved: Jul 16, 2026

Description

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control.

Scores

CVSS	Score	Vector	Source
4.0	6.7 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N	Document Fdn.

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
LibreOfficeThe Document Foundation	26.2 to before < 26.2.5Affected

References

https://www.libreoffice.org/about-us/security/advisories/cve-2026-63269

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.