CVE-2019-9854

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2019-9852, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed by employing a URL encoding attack to defeat the path verification step. However this protection could be bypassed by taking advantage of a flaw in how LibreOffice assembled the final script URL location directly from components of the passed in path as opposed to solely from the sanitized output of the path verification step. This issue affects: Document Foundation LibreOffice 6.2 versions prior to 6.2.7; 6.3 versions prior to 6.3.1.

• CWE-22

• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00055.htmlThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/10/msg00005.htmlThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQKKOIY2DMZCXJINOLIQXD2NWISDKK3N/
• https://seclists.org/bugtraq/2019/Sep/17Mailing List, Third Party Advisory
• https://usn.ubuntu.com/4138-1/Third Party Advisory
• https://www.debian.org/security/2019/dsa-4519Third Party Advisory
• https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9854/Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1769907Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00055.htmlThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/10/msg00005.htmlThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQKKOIY2DMZCXJINOLIQXD2NWISDKK3N/
• https://seclists.org/bugtraq/2019/Sep/17Mailing List, Third Party Advisory
• https://usn.ubuntu.com/4138-1/Third Party Advisory
• https://www.debian.org/security/2019/dsa-4519Third Party Advisory
• https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9854/Vendor Advisory

Published

Sep 6, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9848LibreOffice has a feature where documents can specify that p…9.8
• CVE-2019-9849LibreOffice has a 'stealth mode' in which only documents fro…4.3
• CVE-2019-9850LibreOffice is typically bundled with LibreLogo, a programma…9.8
• CVE-2019-9851LibreOffice is typically bundled with LibreLogo, a programma…9.8
• CVE-2019-9852LibreOffice has a feature where documents can specify that p…7.8
• CVE-2019-9853LibreOffice documents can contain macros. The execution of t…7.8
• CVE-2019-9855LibreOffice is typically bundled with LibreLogo, a programma…9.8
• CVE-2019-9857In the Linux kernel through 5.0.2, the function inotify_upda…
• CVE-2019-9858Remote code execution was discovered in Horde Groupware Webm…8.8
• CVE-2019-9859Vesta Control Panel (VestaCP) 0.9.7 through 0.9.8-23 is vuln…8.8
• CVE-2019-9860Due to unencrypted signal communication and predictability o…
• CVE-2019-9861Due to the use of an insecure RFID technology (MIFARE Classi…