Does anyone know what the threat model is for LibreOffice?<p>For Microsoft Office, VBA Macros are allowed to execute arbitrary code. I assume it's the same for LibreOffice Basic. For files without macros (like this exploit) what are the boundaries that should be enforced? It looks like Excel supports reading data from named files by design.[1] Is it ever safe to open a partially-trusted file in LibreOffice?<p>Edit: Some quick testing reveals that external links do work in LibreOffice Calc. If you answer "Yes" to "This file contains links to other files. Should they be updated?" on startup, it can read any file (and presumably use WEBSERVICE to upload the contents via query string).<p>1. <a href="https://support.office.com/en-us/article/create-an-external-reference-link-to-a-cell-range-in-another-workbook-c98d1803-dd75-4668-ac6a-d7cca2a9b95f" rel="nofollow">https://support.office.com/en-us/article/create-an-external-...</a>