CVE-2023-34088
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A stored XSS vulnerability was found in Collabora Online prior to versions 22.05.13, 21.11.9.1, and 6.4.27, allowing an attacker to inject malicious code via document names. When an administrator opened the admin console, the document name could be executed as a script, risking the leak of the JWT.
Risk Assessment
This vulnerability could lead to session hijacking of the administrator and exposure of sensitive information, posing a serious threat to organizational security.
Recommendation
It is recommended to upgrade Collabora Online to version 22.05.13 or higher, 21.11.9.1 or higher, and 6.4.27 or higher to mitigate this vulnerability.
Other vulnerabilities in Collabora Online
See all- CVE-2025-66208Critical
Collabora Online - Built-in CODE Server (richdocumentscode) prior to 25.04.702 has a Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy. Users of Nextcloud with Collabora Online - Built-in CODE Server app can be vulnerable to attack via proxy.php and an intermediate reverse proxy.
- CVE-2026-48164Medium
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the host_session_id query/form parameter is substituted into the cool.html editor page without HTML encoding, unlike parameters passed through the existing variable-encoding mechanism. An attacker who induces a victim to load a crafted URL can inject HTML and, in the absence of an effective Content Security Policy, execute scripts in the Collabora Online iframe's origin, exposing the session authentication token and page contents. A reverse proxy that preserves the Content Security Policy header sent by coolwsd mitigates the script-execution scenario. This issue is fixed in versions 24.04.18 and 25.04.11.
- CVE-2026-46499Medium
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, several document operations delegated to LibreOfficeKit in the per-document kit process fail to enforce a session's read-only state. A read-only user, such as a viewer-role WOPI user, can send crafted WebSocket messages to execute document-mutating UNO commands and dialog operations despite the read-only interface. The changes can mislead co-viewers within the live session, or an authorized editor sharing the session can unknowingly save the modifications. The read-only attacker cannot save the document directly, and changes are discarded when the kit session ends unless an authorized editor saves them. This issue is fixed in versions 24.04.18 and 25.04.11.
Original NVD description (English source)
Collabora Online is a collaborative online office suite. A stored cross-site scripting (XSS) vulnerability was found in Collabora Online prior to versions 22.05.13, 21.11.9.1, and 6.4.27. An attacker could create a document with an XSS payload as a document name. Later, if an administrator opened the admin console and navigated to the history page, the document name was injected as unescaped HTML and executed as a script inside the context of the admin console. The administrator JSON web token (JWT) used for the websocket connection could be leaked through this flaw. Users should upgrade to Collabora Online 22.05.13 or higher; Collabora Online 21.11.9.1 or higher; Collabora Online 6.4.27 or higher to receive a patch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS