online
25.04.7-mobileIssue tracker only. Active development is on Gerrit at https://gerrit.collaboraoffice.com/.
- Maintenance
- Active27 commits in 3 months · bus factor 7
- License
- OtherUnknown
- Security
- 23 advisories3 critical, 10 high, 8 medium, 2 low
- Supported versions
- No scheduleendoflife.date does not track this project
3.4k stars · 1k forks · 872 open issues · last release 11 months ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 23 most recent advisories published by the maintainers: 3 critical, 10 high, 8 medium, 2 low. Check the patched version against the one you run.
- criticalCVE-2026-110447Oct 14, 2026Unauthenticated OS command injection in the richdocumentscode proxy
- Affected
- < 26.4.303
- Patched in
- 26.4.303
- mediumCVE-2026-55243Sep 25, 2026CVE-2026-55243 Comment author is not validated, allowing false attribution
- Affected
- <25.04.11; < 24.04.19; < 26.04.2
- Patched in
- 25.04.11; 24.04.19; 26.04.2
- highCVE-2026-77276Sep 3, 2026CVE-2026-77276 Unauthenticated document conversion could run document macros
- Affected
- < 25.04.12.3; < 26.04.2.2
- Patched in
- 25.04.12.3; 26.04.2.2
- mediumCVE-2026-46499Jun 24, 2026CVE-2026-46499 Read-only session enforcement bypass allows document modification within a live session
- Affected
- < 25.04.11; < 24.04.18
- Patched in
- 25.04.11; 24.04.18
- mediumCVE-2026-48164Jun 24, 2026CVE-2026-48164 Reflected HTML injection in Collabora Online cool.html
- Affected
- < 25.04.11; < 24.04.18
- Patched in
- 25.04.11; 24.04.18
- mediumCVE-2026-23623Feb 5, 2026CVE-2026-23623 Authorization Bypass: ability to download read-only files in Collabora Online
- Affected
- < 25.04.08.2; < 25.04.7.5; < 24.04.17.3; < 23.05.20.1
- Patched in
- 25.04.08.2; 25.04.7.5; 24.04.17.3; 23.05.20.1
- mediumCVE-2025-66208Dec 3, 2025CVE-2025-66208 Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy
- Affected
- < 25.04.702
- Patched in
- 25.04.702
- highCVE-2025-27791Apr 15, 2025CVE-2025-27791 Arbitrary file write outside with malicious WOPI server
- Affected
- < 24.04.13.1; < 23.05.19; < 22.05.25
- Patched in
- 24.04.13.1; 23.05.19; 22.05.25
- mediumCVE-2025-24796Mar 6, 2025CVE-2025-24796 Remote Code Execution within Collabora Online jail with Macros Enabled
- Affected
- < 24.04.12.4; < 23.05.19; < 22.05.25
- Patched in
- 24.04.12.4; 23.05.19; 22.05.25
- mediumCVE-2024-45045Aug 29, 2024CVE-2024-45045 JavaScript Injection via url encoded values in links
- Affected
- < 24.04.6.2
- Patched in
- 24.04.6.2
- highCVE-2024-37311Aug 23, 2024CVE-2024-37311 Remote host TLS certificates are not fully verified
- Affected
- < 24.04.4.3; < 23.05.14.1; < 22.05.23.1
- Patched in
- 24.04.4.3; 23.05.14.1; 22.05.23.1
- lowCVE-2024-5261Jul 3, 2024CVE-2024-5261 TLS certificates are not properly verified when utilizing LibreOfficeKit
- Affected
- < 24.04.3; < 23.05.12; < 22.05.23
- Patched in
- 24.04.3; 23.05.12; 22.05.23
- highCVE-2024-29182Apr 2, 2024CVE-2024-29182 Stored Cross-Site-Scripting vulnerability via tooltip
- Affected
- < 23.05.10.1
- Patched in
- 23.05.10.1
- lowCVE-2024-25114Mar 11, 2024CVE-2024-25114 Sensitive Information Disclosure (JailID) to users
- Affected
- < 23.05.9; < 22.05.22; < 21.11.9.4
- Patched in
- 23.05.9; 22.05.22; 21.11.9.4
- highCVE-2023-49788Dec 8, 2023CVE-2023-49788 Improper handling of browser-side provided input in richdocuments path handling
- Affected
- < 23.5.602
- Patched in
- 23.5.602
- highCVE-2023-49782Dec 8, 2023CVE-2023-49782 Cross-Site-Scripting vulnerability in richdocuments error message handling
- Affected
- < 23.5.601
- Patched in
- 23.5.601
- highCVE-2023-48314Nov 27, 2023CVE-2023-48314 Unescaped passing of the request URL
- Affected
- <23.5.403
- Patched in
- 23.5.403
- criticalCVE-2023-34088May 31, 2023CVE-2023-34088 Stored Cross-Site-Scripting vulnerability in admin interface
- Affected
- < 22.05.13; < 21.11.9.1; < 6.4.27
- Patched in
- 22.05.13; 21.11.9.1; 6.4.27
- mediumCVE-2023-31145May 13, 2023CVE-2023-31145: Reflected XSS vulnerability
- Affected
- <22.05.13, <21.11.9; <6.4.27
- Patched in
- 22.05.13, 21.11.9; 6.4.27
- highCVE-2021-43817Dec 13, 2021CVE-2021-43817: Reflected Cross-Site-Scripting vulnerability
- Affected
- < 6.4.16 and < 4.2.20
- Patched in
- 6.4.16 and 4.2.20
- criticalCVE-2021-32744Jul 21, 2021CVE-2021-32744: Unauthenticated attacker could gain access to currently open files
- Affected
- < 6.4.9-6 and <4.2.17-2
- Patched in
- 6.4.9-6 and 4.2.17-2
- highCVE-2021-32745Jul 21, 2021CVE-2021-32745: Reflected Cross-Site-Scripting vulnerability
- Affected
- < 6.4.9-5
- Patched in
- 6.4.9-5
- highCVE-2021-25630Jan 26, 2021CVE-2021-25630: "loolforkit" privileged program local root exploit
- Affected
- < 6.4.3 and <4.2.13
- Patched in
- 6.4.3 and 4.2.13