SZB-cadcb9a420
EUVD lists unencoded host_session_id parameter in Collabora Online (EUVD-2026-114089)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Collabora
- Product
- Collabora Online
- First seen
Summary
A Mastodon post relaying an EUVD entry says Collabora Online versions before 24.04.18 and 25.04.11 insert the host_session_id parameter into the cool.html editor page without HTML encoding. The entry gives a CVSS v3.1 score of 4.7/10.
If you use Collabora
Check whether your Collabora Online version is below 24.04.18 or 25.04.11
Update to 24.04.18, 25.04.11, or a later fixed release
Review the EUVD-2026-114089 entry for vendor guidance
What the sources say 1
· Mastodon: “Prior to 24.04.18 and 25.04.11, the `host_session_id` query/form parameter is substituted into the `cool.html` editor page without HTML encoding, unlike...” Source