{"api_version":"1","generated_at":"2026-11-04T13:21:23+00:00","cve":"CVE-2026-90632","urls":{"html":"https://cve.report/CVE-2026-90632","api":"https://cve.report/api/cve/CVE-2026-90632.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-90632","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-90632"},"summary":{"title":"Apache OpenOffice: Local file inclusion via GStreamer plugin","description":"Apache OpenOffice documents can include multimedia content (audio, video, etc.)\n\nA crafted document could exploit the GStreamer multimedia component of Apache OpenOffice version through 4.1.16 to load the contents of any local file, and include them when the document is saved or exported, for example as PDF.\n\nUsers are recommended to upgrade to version 4.1.17, which fixes this issue.","state":"PUBLISHED","assigner":"apache","published_at":"2026-11-04 11:17:19","updated_at":"2026-11-04 11:17:19"},"problem_types":["CWE-552","CWE-552 CWE-552 Files or directories accessible to external parties"],"metrics":[],"references":[{"url":"https://lists.apache.org/thread.html/9rrjtmlnmg47m6soyrl83rz28dbsyqvk","name":"https://lists.apache.org/thread.html/9rrjtmlnmg47m6soyrl83rz28dbsyqvk","refsource":"security@apache.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90632","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90632","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache OpenOffice","version":"affected 4.1.16 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Edoardo Geraci and Thomas Rinsma of Codean Labs","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/openoffice","product":"Apache OpenOffice","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.1.16","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Edoardo Geraci and Thomas Rinsma of Codean Labs"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<div>Apache OpenOffice documents can include multimedia content (audio, video, etc.)</div><div>A crafted document could exploit the GStreamer multimedia component of Apache OpenOffice version through 4.1.16 to load the contents of any local file, and include them when the document is saved or exported, for example as PDF.</div>Users are recommended to upgrade to version 4.1.17, which fixes this issue."}],"value":"Apache OpenOffice documents can include multimedia content (audio, video, etc.)\n\nA crafted document could exploit the GStreamer multimedia component of Apache OpenOffice version through 4.1.16 to load the contents of any local file, and include them when the document is saved or exported, for example as PDF.\n\nUsers are recommended to upgrade to version 4.1.17, which fixes this issue."}],"metrics":[{"other":{"content":{"text":"important"},"type":"Textual description of severity"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-552","description":"CWE-552 Files or directories accessible to external parties","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-04T11:05:00.779Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache"},"references":[{"tags":["vendor-advisory"],"url":"https://lists.apache.org/thread.html/9rrjtmlnmg47m6soyrl83rz28dbsyqvk"}],"source":{"discovery":"EXTERNAL"},"title":"Apache OpenOffice: Local file inclusion via GStreamer plugin","x_generator":{"engine":"Vulnogram 1.0.3"}}},"cveMetadata":{"assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","assignerShortName":"apache","cveId":"CVE-2026-90632","datePublished":"2026-11-04T11:05:00.779Z","dateReserved":"2026-09-12T20:52:24.484Z","dateUpdated":"2026-11-04T11:05:00.779Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-04 11:17:19","lastModifiedDate":"2026-11-04 11:17:19","problem_types":["CWE-552","CWE-552 CWE-552 Files or directories accessible to external parties"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"90632","Ordinal":"1","Title":"Apache OpenOffice: Local file inclusion via GStreamer plugin","CVE":"CVE-2026-90632","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"90632","Ordinal":"1","NoteData":"Apache OpenOffice documents can include multimedia content (audio, video, etc.)\n\nA crafted document could exploit the GStreamer multimedia component of Apache OpenOffice version through 4.1.16 to load the contents of any local file, and include them when the document is saved or exported, for example as PDF.\n\nUsers are recommended to upgrade to version 4.1.17, which fixes this issue.","Type":"Description","Title":"Apache OpenOffice: Local file inclusion via GStreamer plugin"}]}}}