CVE-2025-27791

Collabora Online is a collaborative online office suite based on LibreOffice technology. In versions prior to 24.04.12.4, 23.05.19, and 22.05.25, there is a path traversal flaw in handling the CheckFileInfo BaseFileName field returned from WOPI servers. This allows for a file to be written anywhere the uid running Collabora Online can write, if such a response was supplied by a malicious WOPI server. By combining this flaw with a Time of Check, Time of Use DNS lookup issue with a WOPI server address under attacker control, it is possible to present such a response to be processed by a Collabora Online instance. This issue has been patched in versions 24.04.13.1, 23.05.19, and 22.05.25.

• CWE-23

• https://github.com/CollaboraOnline/online/security/advisories/GHSA-9j32-gg3j-8w25

Published

Apr 15, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27785Applio is a voice conversion tool. Versions 3.2.8-bugfix and…7.5
• CVE-2025-27786Applio is a voice conversion tool. Versions 3.2.8-bugfix and…9.1
• CVE-2025-27787Applio is a voice conversion tool. Versions 3.2.8-bugfix and…7.5
• CVE-2025-27788JSON is a JSON implementation for Ruby. Starting in version …7.5
• CVE-2025-27789Babel is a compiler for writing next generation JavaScript. …6.2
• CVE-2025-2779The Insert Headers and Footers Code – HT Script plugin for W…6.5
• CVE-2025-27792Opal is OBiBa’s core database application for biobanks or ep…7.7
• CVE-2025-27793Vega is a visualization grammar, a declarative format for cr…5.3
• CVE-2025-27794Flarum is open-source forum software. A session hijacking vu…6.8
• CVE-2025-27795ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks im…7.5
• CVE-2025-27796ReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandl…9.8
• CVE-2025-27797OS command injection vulnerability in the specific service e…9.8