{"id":"CVE-2026-90627","kind":"vulnerability","aliases":["CVE-2026-90627"],"related":[],"title":"Apache OpenOffice: crafted document reads any local file silently","description":"The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the contents of any local file without asking the user.\nUsers are recommended to upgrade to version 4.1.17, which fixes this issue.","summary":"The flat file database driver in Apache OpenOffice through 4.1.16 lets a crafted document read the contents of any local file without asking the user. An attacker who gets a user to open such a document can read files the user can access.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","openoffice","package"],"not_affected_if":["not-installed"],"how_to_check":"- Check the installed OpenOffice version (Help > About) and confirm whether it is `4.1.16` or earlier.","fix":"- Upgrade Apache OpenOffice to `4.1.17`.","status":"open","published_at":"2026-11-04T11:17:19+00:00","first_seen_at":"2026-11-04T11:26:46+00:00","triaged_at":"2026-11-04T11:27:40+00:00","updated_at":"2026-11-04T11:27:40+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T11:27:40Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache OpenOffice to `4.1.17`.","reach":"local","title":"Apache OpenOffice: crafted document reads any local file silently","impact":"medium","summary":"The flat file database driver in Apache OpenOffice through 4.1.16 lets a crafted document read the contents of any local file without asking the user. An attacker who gets a user to open such a document can read files the user can access.","audience":"everyone","category":"package","nicknames":[],"who_cares":["openoffice","desktop"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads arbitrary local files via a crafted document.","analyst_note":"","how_to_check":"- Check the installed OpenOffice version (Help > About) and confirm whether it is `4.1.16` or earlier.\n- unknown","plain_action":"Update Apache OpenOffice to version 4.1.17 or later.","needs_analyst":false,"not_affected_if":["not-installed"],"who_is_affected":"Anyone running Apache OpenOffice through 4.1.16 is exposed, since the flaw is in the flat file database driver that processes documents. The sources do not say which document types or configurations trigger it beyond opening a crafted document, so systems without OpenOffice can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000652,"input_tokens":4094,"output_tokens":485,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-90627':12A,15A '4.1.16':28B,72C '4.1.17':96C 'access':61B 'allow':73C 'apach':1A,25B,68C 'ask':41B,86C 'attack':45B 'content':35B,80C 'craft':3A,31B,75C 'cve':10A,13A 'databas':22B,65C 'desktop':16B 'document':4A,32B,54B,76C 'driver':23B,66C 'file':8A,21B,39B,57B,64C,84C 'fix':98C 'flat':20B,63C 'get':47B 'issu':100C 'let':29B 'local':7A,38B,83C 'open':51B 'openoffic':2A,17B,26B,69C 'packag':18B 'read':5A,33B,56B,78C 'recommend':91C 'silent':9A 'upgrad':93C 'user':43B,49B,59B,88C,89C 'version':70C,95C 'without':40B,85C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Apache OpenOffice through 4.1.16 is exposed, since the flaw is in the flat file database driver that processes documents. The sources do not say which document types or configurations trigger it beyond opening a crafted document, so systems without OpenOffice can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Apache OpenOffice to version 4.1.17 or later.","pkeys":[],"ptokens":[],"labels":["desktop","high","openoffice","package"],"campaign_type":null,"first_public_at":"2026-11-04T11:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90627","severity":null,"published_at":"2026-11-04T11:17:19+00:00","modified_at":"2026-11-04T11:17:19+00:00","first_seen_at":"2026-11-04T11:26:46+00:00","fetched_at":"2026-11-04T11:26:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}