Collabora Online CVE-2026-48164

Exploitation requires the attacker to induce a victim to load a crafted Collabora Online editor URL containing a malicious host_session_id query/form parameter (UI:R); no authentication is required of the attacker (PR:N). The primary limiting factor is Content Security Policy: the injected HTML always reflects into cool.html, but script execution (and thus theft of the session authentication token and page contents) occurs only in the absence of an effective CSP. Because coolwsd sends a CSP header by default, full script-execution exploitation realistically requires a deployment where a reverse proxy strips or fails to preserve that header - the vendor-stated workaround is ensuring the reverse proxy does not strip the coolwsd CSP. Affected: Collabora Online coolwsd before 24.04.18 and before 25.04.11.

This is a medium-severity reflected cross-site scripting / HTML-injection issue (NVD CVSS 3.1 base 4.7, vector AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N). The network vector and lack of required privileges (PR:N) make it remotely reachable by unauthenticated attackers, but UI:R means a victim must be induced to open an attacker-crafted URL, which bounds mass, automated exploitation. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public exploit was provided in the input (only the GHSA advisory and the fix commit are referenced), so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', i.e. a patch-this-cycle priority rather than an emergency. A notable signal conflict exists: NVD scored confidentiality impact as C:N, yet the vendor advisory explicitly states the flaw exposes the session authentication token and page contents - that is a confidentiality exposure, so the NVD C:N rating appears to understate real impact and should be verified. A second mitigating factor is central to real-world risk: script execution only occurs 'in the absence of an effective Content Security Policy', and coolwsd emits a CSP by default, so a default deployment behind a reverse proxy that preserves that header is largely protected against the script-execution path. Net assessment: a genuine but conditional medium-risk issue, not a drop-everything emergency, and worth patching within the current cycle especially where reverse-proxy CSP handling is uncertain.

An attacker crafts a Collabora Online editor URL in which the host_session_id query/form parameter carries an HTML/script payload and lures a victim (e.g. an authenticated document user) into opening it. Because host_session_id is substituted into cool.html without HTML encoding, the payload is reflected into the editor page; where no effective Content Security Policy is enforced, the injected script runs in the Collabora Online iframe's origin and can read the session authentication token and page contents. No public proof-of-concept was provided in the input, and successful script execution additionally depends on the target deployment lacking an effective CSP.