Cyber ·
CVE-2026-90627: Apache OpenOffice lets a crafted document read local files
Security advisory dated November 3, 2026 describes a flaw in Apache OpenOffice up to version 4.1.16 that allows a crafted document to read local files without asking the user for authorization. The fix is in version 4.1.17.
The advisory CVE-2026-90627, posted to the oss-sec list on November 3, 2026 and rated important, covers a flaw in Apache OpenOffice. According to the received text, the single-file database driver in versions up to 4.1.16 lets a purpose-built document read the contents of any local file without asking the user for authorization. The issue involves the SQL provider and references to single-file databases. The credited discoverers are Edoardo Geraci and Thomas Rinsma, of Codean Labs. The advisory recommends updating to version 4.1.17, which fixes the problem.
The relevance for an organization lies in the risk that documents received by e-mail or shared internally could expose sensitive files on the computer of whoever opens them. Anyone using OpenOffice should check the installed version, update to 4.1.17 or later, and treat documents from unknown sources with caution. The Rota Nacional platform does not fix or handle this flaw, which belongs to office software. To check the details, consult the original advisory on seclists.org and the official Apache OpenOffice project page.