High severity · published Dec 8, 2023
CVE-2023-49788
Improper handling of browser-side provided input in richdocuments path handling
7.2
CVSS
0.5%
EPSS
No
On KEV
Description
Collabora Online is a collaborative online office suite based on LibreOffice technology. Unlike a standalone dedicated Collabora Online server, the Built-in CODE Server (richdocumentscode) is run without chroot sandboxing. Vulnerable versions of the richdocumentscode app can be susceptible to attack via modified client->server commands to overwrite files outside the sub directory the server has provided for the transient session. Files which can be accessed are limited to those that the server process has access to. The bug was fixed in Collabora Online - Built-in CODE Server (richdocumentscode) release 23.5.602. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ON
online · CollaboraOnline
< 23.5.602 · source: vendor
RI
Richdocumentscode · Collaboraoffice
before 23.5.602 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-49788
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-49788
Vendor Advisory
https://github.com/CollaboraOnline/online/security/advisories/GHSA-3r69-xvf7-v94j
More from online
9.8
CVE-2025-66208
Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy
8.3
CVE-2025-27791
Collabora Online Vulnerable to Arbitrary File Write
8.2
CVE-2024-37311
Collabora Online's remote host TLS certificates are not fully verified
6.3
CVE-2025-24796
Remote Code Execution within Collabora Online jail with Macros Enabled
6.1
CVE-2024-45045
JavaScript Injection via url encoded values in links in Collabora Office Android