HTML Injection Vulnerability in Collabora Online by Collabora

CVE-2026-48164

What is CVE-2026-48164?

Collabora Online, a collaborative office suite leveraging LibreOffice technology, is susceptible to an HTML injection vulnerability caused by improper handling of the host_session_id parameter in the cool.html editor page. This flaw allows attackers to manipulate URL parameters, enabling script execution in the iframe context of Collabora Online. If a victim is tricked into loading a specially crafted URL, their session authentication token and page contents may be exposed. To mitigate the risks associated with this vulnerability, it is essential to implement an effective Content Security Policy and to use a reverse proxy that preserves the required headers. The issue has been resolved in updated versions 24.04.18 and 25.04.11.

References