CVE-2023-1183: LibreOffice ODB database/script file write via crafted SCRIPT command

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityThe flaw allows attacker-chosen file writes but requires local access and user interaction to open a crafted document, and no known exploitation is recorded.

What it is

LibreOffice fails to properly validate input in a crafted ODB file containing a "database/script" entry with a SCRIPT command, allowing file contents to be written to an attacker-chosen location. The flaw combines improper input validation with path traversal, so opening a malicious document can place attacker-controlled files anywhere the user can write.

Impact

An attacker gains the ability to write arbitrary file contents to a location of their choosing on the victim's system, which can overwrite files or plant content for follow-on attacks. The CVSS vector shows high integrity impact with no confidentiality or availability impact.

Attack surface

Reached locally by opening a crafted ODB file in LibreOffice; the vector AV:L/PR:N/UI:R means no privileges are needed but the victim must open the malicious document. No remote or unauthenticated network path is described.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is high (0.64635, 99.2nd percentile), and references include a vendor patch advisory, but no public exploit tag is present in the record.

What to do

• Apply the LibreOffice patch referenced in the vendor security advisory for CVE-2023-1183, and update Fedora and Red Hat Enterprise Linux packages to their fixed builds.
• Treat untrusted ODB/database documents as risky: block or quarantine them at email and web gateways where business use does not require them.
• Restrict write permissions for users who routinely open external documents, and avoid running LibreOffice with elevated privileges.
• Enable LibreOffice macro and scripting security settings that block or warn on embedded script execution.
• Monitor for unexpected file creation in user-writable directories after document opens.

Detection

• Alert on LibreOffice processes writing files to unusual or sensitive paths (startup folders, config directories, shared locations) shortly after opening a document.
• Hunt for ODB files containing embedded "database/script" entries with SCRIPT commands in email attachments and file shares.
• Correlate file-creation events with recent LibreOffice document opens on endpoints to spot attacker-chosen write locations.
• Review endpoint logs for new files appearing in user profile or system directories with content inconsistent with normal application behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.