cve.bz

CVE-2024-30265

7.5 highEPSS 0.7%

High (7.5). EPSS 0.7% chance of exploitation in the next 30 days. Fixed in voila 0.2.17, 0.3.8, 0.4.4.

Collabora Online is a collaborative online office suite based on LibreOffice technology. Any deployment of voilà dashboard allow local file inclusion. Any file on a filesystem that is readable by the user that runs the voilà dashboard server can be downloaded by someone with network access to the server. Whether this still requires authentication depends on how voilà is deployed. This issue has been patched in 0.2.17, 0.3.8, 0.4.4 and 0.5.6.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWE
CWE-73
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-2q59-h24c-w6fgPyPIvoila>=0.0.2 <0.2.170.2.17
GHSA-2q59-h24c-w6fgPyPIvoila>=0.3.0a0 <0.3.80.3.8
GHSA-2q59-h24c-w6fgPyPIvoila>=0.4.0a0 <0.4.40.4.4
GHSA-2q59-h24c-w6fgPyPIvoila>=0.5.0a0 <0.5.60.5.6
PYSEC-2026-2027PyPIvoila>=0.0.2 <0.2.17
>=0.3.0a0 <0.3.8
>=0.4.0a0 <0.4.4
>=0.5.0a0 <0.5.6		0.2.17, 0.3.8, 0.4.4, 0.5.6

References

Check your stackJSON