Apache OpenOffice: Local file inclusion in flat file database driver (CVE-2026-90627)
Apache OpenOffice versions through 4.1.16 contain a local file inclusion vulnerability in the flat file database driver that allows arbitrary file reads via crafted documents.
CVE search metadata
CVE search record: CVE-2026-90627. KEV: no. Product: OpenOffice (<= 4.1.16). Brief: Apache OpenOffice: Local file inclusion in flat file database driver (CVE-2026-90627). Brief link: https://feed.craftedsignal.io/briefs/2026-11-apache-openoffice-lfi/
Triage facts
Revision 1- Applicability
- OpenOffice (<= 4.1.16)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 4, 06:25 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
A vulnerability exists in the flat file database driver within Apache OpenOffice versions through 4.1.16. This flaw allows a maliciously crafted document to read local files on the underlying system without user permission or interaction. Apache has released version 4.1.17 to remediate this issue.
Impact
Successful exploitation allows for unauthorized reading of arbitrary files from the local filesystem with the privileges of the user running the Apache OpenOffice process.
Recommendation
- Upgrade all instances of Apache OpenOffice to version 4.1.17 or later immediately.
- Inventory systems running Apache OpenOffice version 4.1.16 or earlier.
- Apply the principle of least privilege to the user accounts running Office software to limit the scope of potential file access in the event of document-based exploitation.
Immediate actions
Patch Apache OpenOffice to version 4.1.17
Threat Hunt
Identify documents containing database references or suspicious external links in document metadata
Data: Document metadata analysis, File system access logs
Mitigations
Upgrade to Apache OpenOffice 4.1.17
CVE-2026-90627