CVE-2024-30265

Collabora Online is a collaborative online office suite based on LibreOffice technology. Any deployment of voilà dashboard allow local file inclusion. Any file on a filesystem that is readable by the user that runs the voilà dashboard server can be downloaded by someone with network access to the server. Whether this still requires authentication depends on how voilà is deployed. This issue has been patched in 0.2.17, 0.3.8, 0.4.4 and 0.5.6.

• CWE-73

• https://github.com/voila-dashboards/voila/commit/00d6362c237b6b4d466873535554d6076ead0c52
• https://github.com/voila-dashboards/voila/commit/28faacc9b03b160fd8fa920ad045f4ec0667ab67
• https://github.com/voila-dashboards/voila/commit/5542e4ae36bb5d184deaa48f95e76be477756af2
• https://github.com/voila-dashboards/voila/commit/98b6a40fec27723572314fdbba99bdc147d904c8
• https://github.com/voila-dashboards/voila/commit/c045be6988539d07cceeb9f82fc660a49485d504
• https://github.com/voila-dashboards/voila/security/advisories/GHSA-2q59-h24c-w6fg
• https://github.com/voila-dashboards/voila/commit/00d6362c237b6b4d466873535554d6076ead0c52
• https://github.com/voila-dashboards/voila/commit/28faacc9b03b160fd8fa920ad045f4ec0667ab67
• https://github.com/voila-dashboards/voila/commit/5542e4ae36bb5d184deaa48f95e76be477756af2
• https://github.com/voila-dashboards/voila/commit/98b6a40fec27723572314fdbba99bdc147d904c8
• https://github.com/voila-dashboards/voila/commit/c045be6988539d07cceeb9f82fc660a49485d504
• https://github.com/voila-dashboards/voila/security/advisories/GHSA-2q59-h24c-w6fg

Published

Apr 3, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-3026The WordPress Button Plugin MaxButtons WordPress plugin befo…5.4
• CVE-2024-30260Undici is an HTTP/1.1 client, written from scratch for Node.…4.3
• CVE-2024-30261Undici is an HTTP/1.1 client, written from scratch for Node.…3.5
• CVE-2024-30262Contao is an open source content management system. Prior to…7.1
• CVE-2024-30263macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozill…7.7
• CVE-2024-30264Typebot is an open-source chatbot builder. A reflected cross…9.3
• CVE-2024-30266wasmtime is a runtime for WebAssembly. The 19.0.0 release of…5.5
• CVE-2024-30268Cacti provides an operational monitoring and fault managemen…6.1
• CVE-2024-30269DataEase, an open source data visualization and analysis too…5.3
• CVE-2024-3027The Smart Slider 3 plugin for WordPress is vulnerable to una…6.4
• CVE-2024-30270mailcow: dockerized is an open source groupware/email suite …6.2
• CVE-2024-30271Illustrator versions 28.3, 27.9.2 and earlier are affected b…7.8