{"id":"CVE-2026-48164","kind":"vulnerability","aliases":["CVE-2026-48164"],"related":[],"title":"Collabora Online: crafted URL injects script into the editor page","description":"Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the `host_session_id` query/form parameter is substituted into the `cool.html` editor page without HTML encoding, unlike parameters passed through the existing variable-encoding mechanism. An attacker who induces a victim to load a crafted URL can inject HTML and, in the absence of an effective `Content Security Policy`, execute scripts in the Collabora Online iframe's origin, exposing the session authentication token and page contents. A reverse proxy that preserves the `Content Security Policy` header sent by `coolwsd` mitigates the script-execution scenario. This issue is fixed in versions 24.04.18 and 25.04.11.","summary":"Collabora Online does not HTML-encode the host_session_id parameter when it is placed into the cool.html editor page. An attacker who gets a victim to open a crafted link can run scripts in the Collabora iframe and read the session token and page contents, unless a Content Security Policy blocks it.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["collabora-online","coolwsd","nextcloud","package","self-hosted"],"not_affected_if":["csp-enforced","fixed-version","managed-hosting"],"how_to_check":"- Check the installed Collabora Online version (`coolwsd --version` or the package version) against the fixed ranges below.\n- Check whether the server or reverse proxy sends a `Content-Security-Policy` header on `cool.html` responses.","fix":"- Collabora Online `24.04.18` for the 24.04 line\n- Collabora Online `25.04.11` for the 25.04 line","status":"open","published_at":"2026-10-30T15:16:52+00:00","first_seen_at":"2026-10-30T15:31:11+00:00","triaged_at":"2026-10-30T15:33:51+00:00","updated_at":"2026-10-30T15:33:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T15:33:51Z","model":"claude-haiku-5-5","output":{"fix":"- Collabora Online `24.04.18` for the 24.04 line\n- Collabora Online `25.04.11` for the 25.04 line","reach":"internet","title":"Collabora Online: crafted URL injects script into the editor page","impact":"medium","summary":"Collabora Online does not HTML-encode the host_session_id parameter when it is placed into the cool.html editor page. An attacker who gets a victim to open a crafted link can run scripts in the Collabora iframe and read the session token and page contents, unless a Content Security Policy blocks it.","audience":"businesses","category":"package","nicknames":[],"who_cares":["collabora-online","coolwsd","self-hosted","nextcloud"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs scripts in victim's editor session, reading session token","analyst_note":"","how_to_check":"- Check the installed Collabora Online version (`coolwsd --version` or the package version) against the fixed ranges below.\n- Check whether the server or reverse proxy sends a `Content-Security-Policy` header on `cool.html` responses.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","csp-enforced","managed-hosting"],"who_is_affected":"Teams that run Collabora Online (coolwsd) and expose the editor to users, typically self-hosted or in Nextcloud and ownCloud integrations. A reverse proxy that keeps the Content-Security-Policy header sent by coolwsd reduces the script-execution risk, so instances without that protection or without an effective CSP are most exposed. Instances already on a fixed version can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000735,"input_tokens":4268,"output_tokens":616,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-48164':13A,16A '24.04.18':93C,188C '25.04.11':95C,190C 'absenc':139C 'attack':48B,123C 'authent':158C 'base':87C 'block':78B 'collabor':83C 'collabora':1A,18B,26B,63B,79C,150C 'collabora-onlin':17B 'content':72B,75B,143C,162C,169C 'cool.html':44B,106C 'coolwsd':20B,175C 'craft':3A,56B,131C 'cve':11A,14A 'editor':9A,45B,107C 'effect':142C 'encod':32B,111C,120C 'execut':146C,180C 'exist':117C 'expos':155C 'fix':185C 'get':50B 'header':172C 'host':25B,34B,97C 'html':31B,110C,135C 'html-encod':30B 'id':36B,99C 'ifram':64B,152C 'induc':125C 'inject':5A,134C 'issu':183C 'libreoffic':89C 'link':57B 'load':129C 'mechan':121C 'mitig':176C 'nextcloud':21B 'offic':85C 'onlin':2A,19B,27B,80C,84C,151C 'open':54B 'origin':154C 'packag':22B 'page':10A,46B,71B,108C,161C 'paramet':37B,101C,113C 'pass':114C 'place':41B 'polici':77B,145C,171C 'preserv':167C 'prior':91C 'proxi':165C 'query/form':100C 'read':66B 'revers':164C 'run':59B 'scenario':181C 'script':6A,60B,147C,179C 'script-execut':178C 'secur':76B,144C,170C 'self':24B 'self-host':23B 'sent':173C 'session':35B,68B,98C,157C 'substitut':103C 'suit':86C 'technolog':90C 'token':69B,159C 'unless':73B 'unlik':112C 'url':4A,132C 'variabl':119C 'variable-encod':118C 'version':187C 'victim':52B,127C 'without':109C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Collabora Online (coolwsd) and expose the editor to users, typically self-hosted or in Nextcloud and ownCloud integrations. A reverse proxy that keeps the Content-Security-Policy header sent by coolwsd reduces the script-execution risk, so instances without that protection or without an effective CSP are most exposed. Instances already on a fixed version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-48164","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48164","severity":null,"published_at":"2026-10-30T15:16:52+00:00","modified_at":"2026-10-30T15:16:52+00:00","first_seen_at":"2026-10-30T15:31:11+00:00","fetched_at":"2026-10-30T15:31:11+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}