LibreOffice Calc allows a cell range to be linked to an external data source, and the link is stored within the document. A link of type sql can reference a folder of local text files as a database, so that when the spreadsheet is opened the text files are read into the sheet. This flaw permits an attacker to cause the document to read arbitrary local text files. The weakness is a local file disclosure vulnerability (CWE-200).

The vulnerability affects LibreOffice, as distributed by The Document Foundation. All releases prior to the patched version that enforcing provider restrictions exhibit the flaw. No specific version range is listed in the available data, so administrators should assume that any older release may be impacted.

The CVSS base score of 6.7 indicates a medium severity, and no EPSS score is available. The vulnerability is not in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to supply a malicious spreadsheet file; however, the document will only read files on the local filesystem of the user who opens it. The attack vector is local and depends on the user opening a crafted file. Consequently, the risk is moderate but still relevant to users who handle untrusted documents.