{"cve":"CVE-2019-9854","nvd":{"published":"2019-09-06T19:15:11.997","modified":"2026-06-17T02:44:43.860","status":"Modified","description":"LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2019-9852, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed by employing a URL encoding attack to defeat the path verification step. However this protection could be bypassed by taking advantage of a flaw in how LibreOffice assembled the final script URL location directly from components of the passed in path as opposed to solely from the sanitized output of the path verification step. This issue affects: Document Foundation LibreOffice 6.2 versions prior to 6.2.7; 6.3 versions prior to 6.3.1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-22"],"references":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00055.html","https://lists.debian.org/debian-lts-announce/2019/10/msg00005.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQKKOIY2DMZCXJINOLIQXD2NWISDKK3N/","https://seclists.org/bugtraq/2019/Sep/17"],"products":["canonical:ubuntu_linux","debian:debian_linux","fedoraproject:fedora","libreoffice:libreoffice","opensuse:leap","redhat:enterprise_linux"],"source":"nvd","synced_at":"2026-10-19T20:58:39.700375520+00:00"},"epss":{"cve":"CVE-2019-9854","score":0.01756,"percentile":0.7795,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}