CVE-2025-27791: Collaboraonline Online

High severity, CVSS 8.3. EPSS: 0.5% chance of exploitation in the next 30 days.

Collabora Online is a collaborative online office suite based on LibreOffice technology. In versions prior to 24.04.12.4, 23.05.19, and 22.05.25, there is a path traversal flaw in handling the CheckFileInfo BaseFileName field returned from WOPI servers. This allows for a file to be written anywhere the uid running Collabora Online can write, if such a response was supplied by a malicious WOPI server. By combining this flaw with a Time of Check, Time of Use DNS lookup issue with a WOPI server address under attacker control, it is possible to present such a response to be processed by a Collabora Online instance. This issue has been patched in versions 24.04.13.1, 23.05.19, and 22.05.25.

Affected products

• Collaboraonline Online: from 24.04.1.1, before 24.04.13.1 (fixed in 24.04.13.1); from 23.05.0, before 23.05.19 (fixed in 23.05.19); before 22.05.25 (fixed in 22.05.25)

Published 2025-04-15. Last modified 2026-06-17.