Live › vulnerability › CVE-2026-48164
Collabora Online does not HTML-encode the host_session_id parameter when it is placed into the cool.html editor page. An attacker who gets a victim to open a crafted link can run scripts in the Collabora iframe and read the session token and page contents, unless a Content Security Policy blocks it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Teams that run Collabora Online (coolwsd) and expose the editor to users, typically self-hosted or in Nextcloud and ownCloud integrations. A reverse proxy that keeps the Content-Security-Policy header sent by coolwsd reduces the script-execution risk, so instances without that protection or without an effective CSP are most exposed. Instances already on a fixed version can skip it.
No product ranges from the sources yet.
coolwsd --version or the package version) against the fixed ranges below.Content-Security-Policy header on cool.html responses.24.04.18 for the 24.04 line25.04.11Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the host_session_id query/form parameter is substituted into the cool.html editor page without HTML encoding, unlike parameters passed through the existing variable-encoding mechanism. An attacker who induces a victim to load a crafted URL can inject HTML and, in the absence of an effective Content Security Policy, execute scripts in the Collabora Online iframe's origin, exposing the session authentication token and page contents. A reverse proxy that preserves the Content Security Policy header sent by coolwsd mitigates the script-execution scenario. This issue is fixed in versions 24.04.18 and 25.04.11.
This page as .md · .json · in your agent: get_signal("CVE-2026-48164")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.