What is CVE-2026-90627?

CVE-2026-90627 is a medium-severity vulnerability in Apache Openoffice, classified under Files or Directories Accessible to External Parties. CVSS score: 5.5/10. Published 2026-11-04.

How severe is CVE-2026-90627?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Vulnerability in Apache Openoffice

CVE-2026-90627

The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the contents of any local file without asking the user. Users are recommended to upgrade to version 4.1.17, which fixes this issue.

Published 2026-11-04 · last modified 2026-11-05.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Weakness classification (CWE)

CWE-552 — Files or Directories Accessible to External Parties

References

lists.apache.org/thread.html/s7y9fspdysqojnr1z7ppltxtc48b4ljf (vendor-advisory, Mailing List, Vendor Advisory)
af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2026-90627?: CVE-2026-90627 is a medium-severity vulnerability in Apache Openoffice, classified under Files or Directories Accessible to External Parties. CVSS score: 5.5/10. Published 2026-11-04.
How severe is CVE-2026-90627?: Medium severity. CVSS v3 base score is 5.5 out of 10.