OpenOffice (<= 4.1.16) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/openoffice--4.1.16/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 06:25:56 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache OpenOffice: Local file inclusion in flat file database driver (CVE-2026-90627)https://feed.craftedsignal.io/briefs/2026-11-apache-openoffice-lfi/Wed, 04 Nov 2026 06:25:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-apache-openoffice-lfi/Apache OpenOffice versions through 4.1.16 contain a local file inclusion vulnerability in the flat file database driver that allows arbitrary file reads via crafted documents.A vulnerability exists in the flat file database driver within Apache OpenOffice versions through 4.1.16. This flaw allows a maliciously crafted document to read local files on the underlying system without user permission or interaction. Apache has released version 4.1.17 to remediate this issue.

Impact

Successful exploitation allows for unauthorized reading of arbitrary files from the local filesystem with the privileges of the user running the Apache OpenOffice process.

Recommendation

  • Upgrade all instances of Apache OpenOffice to version 4.1.17 or later immediately.
  • Inventory systems running Apache OpenOffice version 4.1.16 or earlier.
  • Apply the principle of least privilege to the user accounts running Office software to limit the scope of potential file access in the event of document-based exploitation.
]]>highadvisorylfivulnerabilityoffice-software