LibreOffice documents can contain URLs constructed to trigger expansion of environment variables or INI file values. When a user opens such a document, the expansion leaks sensitive data to a remote server through the URL, enabling unintended exfiltration of information.

The Document Foundation’s LibreOffice is affected. All releases prior to the security fix are vulnerable; later releases that include the patch reject URLs with internal schemes in XForms instance data and Calc CSV and SQL data providers.

The CVSS score of 6.7 indicates a medium severity vulnerability; the EPSS score of <1% indicates a low likelihood of exploitation, and the vulnerability is not listed in KEV. Attackers can execute this vector by getting a user to open a crafted document containing malicious URLs. The vulnerability permits remote disclosure of internal environment data but requires user interaction and does not allow remote code execution.