# CVE-2026-63268: LibreOffice Calc local file read via SQL data provider

Source: https://junglewise.ai/threats/cve-2026-63268-libreoffice-calc-can-link-a-cell-range-to-an-external-data-source  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-63268 · Severity: info · Published 2026-10-05

LibreOffice Calc allows spreadsheet documents to link to external data sources, with those links saved in the file. An attacker can craft a malicious document with a SQL-type data link pointing to a folder of text files on the victim's computer, causing LibreOffice to read and display local file contents into the spreadsheet when the document opens. This enables unauthorized access to sensitive local files without user interaction beyond opening the document.

Vendors: [The Document Foundation](https://junglewise.ai/threats/vendors/the-document-foundation).

## Quick answers

**Is CVE-2026-63268 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63268 being exploited in the wild.

**How severe is CVE-2026-63268?** Informational severity, published 5 October 2026.

**Which products and versions are affected?** The Document Foundation LibreOffice Calc before 26.2.5 and before 26.8.0.

**Is there a fix for CVE-2026-63268?** Yes: fixed in LibreOffice 26.2.5, 26.8.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63268 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-63268?** Check whether you run The Document Foundation LibreOffice Calc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in LibreOffice 26.2.5, 26.8.0

## Technical details

The vulnerability exploits LibreOffice Calc's calcext:data-mappings feature with SQL providers that support sdbc:flat:file:// database references. When a document is loaded, the SQL provider is restored and can be redirected to read local text files by naming a folder as a database. The attack requires only document opening; the fix restricts data provider restoration to CSV, HTML, and XML formats only.

## Affected products

- The Document Foundation LibreOffice Calc before 26.2.5 and before 26.8.0

## Timeline

- 2026-10-05: disclosed
- 2026-10-05: patched

## References

- [https://www.libreoffice.org/about-us/security/advisories/cve-2026-63268](https://www.libreoffice.org/about-us/security/advisories/cve-2026-63268)