Local Network Vulnerability in Collabora Online Office Suite

CVE-2025-24796

Summary

Collabora Online, a collaborative online office suite derived from LibreOffice, has been found to allow executable binaries to run within a limited environment when macro support is enabled by an administrator. Although macros are disabled by default, their activation could permit execution of arbitrary binaries located in allowed locations, typically within the local network. When the macros are enabled, the framework's architecture makes it feasible to potentially install and execute these binaries, thereby extending beyond the standard network limitations. It is crucial to update to version 24.04.12.4, 23.05.19, 22.05.25, or later to mitigate this risk.

References