{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/office-software/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-90627"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenOffice (\u003c= 4.1.16)"],"_cs_severities":["high"],"_cs_tags":["lfi","vulnerability","office-software"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eA vulnerability exists in the flat file database driver within Apache OpenOffice versions through 4.1.16. This flaw allows a maliciously crafted document to read local files on the underlying system without user permission or interaction. Apache has released version 4.1.17 to remediate this issue.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized reading of arbitrary files from the local filesystem with the privileges of the user running the Apache OpenOffice process.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of Apache OpenOffice to version 4.1.17 or later immediately.\u003c/li\u003e\n\u003cli\u003eInventory systems running Apache OpenOffice version 4.1.16 or earlier.\u003c/li\u003e\n\u003cli\u003eApply the principle of least privilege to the user accounts running Office software to limit the scope of potential file access in the event of document-based exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T06:25:56Z","date_published":"2026-11-04T06:25:56Z","id":"https://feed.craftedsignal.io/briefs/2026-11-apache-openoffice-lfi/","summary":"Apache OpenOffice versions through 4.1.16 contain a local file inclusion vulnerability in the flat file database driver that allows arbitrary file reads via crafted documents.","title":"Apache OpenOffice: Local file inclusion in flat file database driver (CVE-2026-90627)","url":"https://feed.craftedsignal.io/briefs/2026-11-apache-openoffice-lfi/"}],"language":"en","title":"CraftedSignal Threat Feed - Office-Software","version":"https://jsonfeed.org/version/1.1"}