CVE-2025-27791

Deeper analysis

Collabora Online, a collaborative online office suite based on LibreOffice technology, is affected by a path traversal vulnerability in versions prior to 24.04.12.4, 23.05.19, and 22.05.25. The flaw resides in the handling of the CheckFileInfo BaseFileName field returned from WOPI servers and is tracked as CWE-23. It permits an arbitrary file write to any location writable by the Collabora Online process UID when a malicious WOPI server supplies the response, and the issue is compounded by a Time-of-Check/Time-of-Use DNS resolution weakness for attacker-controlled WOPI hostnames.

An unauthenticated attacker who can influence or supply a malicious WOPI server response can exploit the combined flaws to write files on the target system. Successful exploitation requires the Collabora Online instance to contact the attacker-controlled WOPI endpoint, after which the path traversal allows placement of attacker-chosen content at arbitrary filesystem locations reachable by the service UID, resulting in high integrity impact and limited availability impact per the CVSS 8.3 rating.

The referenced GitHub Security Advisory GHSA-9j32-gg3j-8w25 and the vendor patches indicate that the issue has been resolved in Collabora Online releases 24.04.13.1, 23.05.19, and 22.05.25. The EPSS score remains flat at a low value of 0.0116 with no material increase observed after disclosure.