Is CVE-2026-48164 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48164 being exploited in the wild.

How severe is CVE-2026-48164?

Medium severity, with a CVSS score of 4.7, published 30 October 2026.

Which products and versions are affected?

Collabora Online before 24.04.18 and before 25.04.11.

How is CVE-2026-48164 attacked?

It is attacked over the network.

Am I affected by CVE-2026-48164?

Check whether you run Collabora Online at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48164: Collabora Online reflected HTML injection in cool.html

CVE-2026-48164 · Severity: medium · CVSS 4.7 · Published 2026-10-30

Collabora Online is a collaborative office suite that allows multiple users to edit documents in real-time. A vulnerability in the editor page allows attackers to inject malicious HTML by crafting a special URL and tricking a user into clicking it. Without proper security protections, this can expose the user's session authentication token and document contents to the attacker.

Technologies: Collabora Online. Vendors: Collabora.

Quick answers

Is CVE-2026-48164 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48164 being exploited in the wild.
How severe is CVE-2026-48164?: Medium severity, with a CVSS score of 4.7, published 30 October 2026.
Which products and versions are affected?: Collabora Online before 24.04.18 and before 25.04.11.
Is there a fix for CVE-2026-48164?: Yes: fixed in 24.04.18, 25.04.11. Until then: Ensure that any reverse proxy in front of Collabora Online does not strip the Content Security Policy header sent by coolwsd. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48164 attacked?: It is attacked over the network.
Am I affected by CVE-2026-48164?: Check whether you run Collabora Online at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 24.04.18, 25.04.11

Ensure that any reverse proxy in front of Collabora Online does not strip the Content Security Policy header sent by coolwsd.

Technical details

The `host_session_id` query/form parameter is substituted into the `cool.html` editor page without HTML encoding, differing from other parameters that use an existing variable-encoding mechanism. An attacker can inject arbitrary HTML and, absent a Content Security Policy, execute scripts in the Collabora Online iframe's origin to steal session tokens and page data. The fix applies consistent HTML encoding to all variable substitutions via the variable-extraction mechanism.

Affected products

Collabora Online before 24.04.18 and before 25.04.11

Timeline

2026-06-24: disclosed
2026-10-30: patched: versions 24.04.18 and 25.04.11 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.