High severity · published Apr 15, 2025
CVE-2025-27791
Collabora Online Vulnerable to Arbitrary File Write
8.3
CVSS
0.5%
EPSS
No
On KEV
Description
Collabora Online is a collaborative online office suite based on LibreOffice technology. In versions prior to 24.04.12.4, 23.05.19, and 22.05.25, there is a path traversal flaw in handling the CheckFileInfo BaseFileName field returned from WOPI servers. This allows for a file to be written anywhere the uid running Collabora Online can write, if such a response was supplied by a malicious WOPI server. By combining this flaw with a Time of Check, Time of Use DNS lookup issue with a WOPI server address under attacker control, it is possible to present such a response to be processed by a Collabora Online instance. This issue has been patched in versions 24.04.13.1, 23.05.19, and 22.05.25.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ON
online · CollaboraOnline
>= 24.04.1.1, < 24.04.13.1; >= 23.05.0, < 23.05.19; < 22.05.25 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27791
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-27791
github.com
https://github.com/CollaboraOnline/online/security/advisories/GHSA-9j32-gg3j-8w25
More from online
9.8
CVE-2025-66208
Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy
8.2
CVE-2024-37311
Collabora Online's remote host TLS certificates are not fully verified
6.3
CVE-2025-24796
Remote Code Execution within Collabora Online jail with Macros Enabled
6.1
CVE-2024-45045
JavaScript Injection via url encoded values in links in Collabora Office Android
6.1
CVE-2024-29182
Collabora Online Stored Cross-Site-Scripting vulnerability via tooltip