CVE-2026-48164
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the host_session_id query/form parameter is substituted into the cool.html editor page without HTML encoding, unlike parameters passed through the existing variable-encoding mechanism. An attacker who induces a victim to load a crafted URL can inject HTML and, in the absence of an effective Content Security Policy, execute scripts in the Collabora Online iframe's origin, exposing the session authentication token and page contents. A reverse proxy that preserves the Content Security Policy header sent by coolwsd mitigates the script-execution scenario. This issue is fixed in versions 24.04.18 and 25.04.11.
Risk Assessment
An attacker can execute scripts in the context of a victim's Collabora Online session, exposing the session authentication token and page contents, potentially leading to session hijacking.
Recommendation
Upgrade Collabora Online to version 24.04.18 or 25.04.11. Ensure the reverse proxy preserves the Content Security Policy header sent by coolwsd.
Other vulnerabilities in Collabora Online
See all- CVE-2025-66208Critical
Collabora Online - Built-in CODE Server (richdocumentscode) prior to 25.04.702 has a Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy. Users of Nextcloud with Collabora Online - Built-in CODE Server app can be vulnerable to attack via proxy.php and an intermediate reverse proxy.
- CVE-2026-46499Medium
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, several document operations delegated to LibreOfficeKit in the per-document kit process fail to enforce a session's read-only state. A read-only user, such as a viewer-role WOPI user, can send crafted WebSocket messages to execute document-mutating UNO commands and dialog operations despite the read-only interface. The changes can mislead co-viewers within the live session, or an authorized editor sharing the session can unknowingly save the modifications. The read-only attacker cannot save the document directly, and changes are discarded when the kit session ends unless an authorized editor saves them. This issue is fixed in versions 24.04.18 and 25.04.11.
- CVE-2023-34088High
A stored XSS vulnerability was found in Collabora Online prior to versions 22.05.13, 21.11.9.1, and 6.4.27, allowing an attacker to inject malicious code via document names. When an administrator opened the admin console, the document name could be executed as a script, risking the leak of the JWT.
Original NVD description (English source)
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the `host_session_id` query/form parameter is substituted into the `cool.html` editor page without HTML encoding, unlike parameters passed through the existing variable-encoding mechanism. An attacker who induces a victim to load a crafted URL can inject HTML and, in the absence of an effective `Content Security Policy`, execute scripts in the Collabora Online iframe's origin, exposing the session authentication token and page contents. A reverse proxy that preserves the `Content Security Policy` header sent by `coolwsd` mitigates the script-execution scenario. This issue is fixed in versions 24.04.18 and 25.04.11.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS