LibreOffice Calc allows a user to link a cell range to an external data source, storing that link inside the spreadsheet. If that data source is an embedded Firebird database, the database can write files to any location the user has permission to write. The vulnerability permits an attacker to craft a document that, when opened by a user, writes arbitrary files to the user’s writable directories, bypassing normal file‑creation constraints.

The vulnerability affects LibreOffice from The Document Foundation. Affected version information is not listed; only fixed versions restrict Firebird file writes to a private directory.

The CVSS score of 6.8 indicates a moderate to high severity. The EPSS score is not available, and the vulnerability is not included in the CISA KEV catalog, suggesting limited known exploitation. The likely attack vector is a local document opened by a user. An attacker can embed a malicious Firebird database in a spreadsheet; when the user opens the file, the database writes files to writable locations, potentially compromising the system.