CVE-2024-30265

HIGH

Collabora Online - Local File Inclusion

Title source: llm
STIX 2.1

Description

Collabora Online is a collaborative online office suite based on LibreOffice technology. Any deployment of voilà dashboard allow local file inclusion. Any file on a filesystem that is readable by the user that runs the voilà dashboard server can be downloaded by someone with network access to the server. Whether this still requires authentication depends on how voilà is deployed. This issue has been patched in 0.2.17, 0.3.8, 0.4.4 and 0.5.6.

References (6)

Core 6
Core References

Scores

CVSS v3 7.5
EPSS 0.0024
EPSS Percentile 46.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-73
Status published
Products (5)
pypi/voila 0.0.2 - 0.2.17PyPI
voila-dashboards/voila >= 0.0.2, < 0.2.17
voila-dashboards/voila >= 0.3.0a0, < 0.3.8
voila-dashboards/voila >= 0.4.0a0, < 0.4.4
voila-dashboards/voila >= 0.5.0a0, < 0.5.6
Published Apr 03, 2024
Tracked Since Feb 18, 2026