Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

Currently the following Collabora Online versions are supported with security updates.

Version	Supported
25.04.x	✅
24.04.x	✅
23.05.x	✅
22.05.x or older	❌

Reporting a Vulnerability

If you find a security vulnerability in Collabora Online please send an email to [email protected].

Arbitrary file write outside with malicious WOPI server
GHSA-9j32-gg3j-8w25 published Apr 15, 2025 by caolanm

High
CVE-2025-24796 Remote Code Execution within Collabora Online jail with Macros Enabled
GHSA-4jjq-vgqp-qw45 published Mar 6, 2025 by caolanm

Moderate
CVE-2024-5261 TLS certificates are not properly verified when utilizing LibreOfficeKit
GHSA-crg3-fjm2-xvpq published Jul 3, 2024 by caolanm

Low
CVE-2024-37311 Remote host TLS certificates are not fully verified
GHSA-hvhm-5c44-977x published Aug 23, 2024 by caolanm

High
CVE-2024-29182 Stored Cross-Site-Scripting vulnerability via tooltip
GHSA-9gmw-5q2c-4398 published Apr 2, 2024 by caolanm

High
CVE-2024-45045 JavaScript Injection via url encoded values in links
GHSA-78cg-rg4q-26qv published Aug 29, 2024 by caolanm

Moderate
CVE-2024-25114 Sensitive Information Disclosure (JailID) to users
GHSA-2fh2-ppjf-p3xv published Mar 11, 2024 by caolanm

Low
CVE-2023-49788 Improper handling of browser-side provided input in richdocuments path handling
GHSA-3r69-xvf7-v94j published Dec 8, 2023 by caolanm

High
CVE-2023-49782 Cross-Site-Scripting vulnerability in richdocuments error message handling
GHSA-8xm5-pgfr-8mjr published Dec 8, 2023 by caolanm

High
CVE-2023-48314 Unescaped passing of the request URL
GHSA-qjrm-q4h5-v3r2 published Nov 27, 2023 by timar

High

Learn more about advisories related to CollaboraOnline/online in the GitHub Advisory Database