Vulnerability · Published Dec 3, 2025 · Assigned by GitHub_M
CVE-2025-66208Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy
High 7.2
In plain English
A high-severity OS command injection in online from CollaboraOnline. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online. In versions prior to 25.04.702, Collabora Online has a Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy. Users of Nextcloud with Collabora Online - Built-in CODE Server app can be vulnerable to attack via proxy.php and an intermediate reverse proxy. This vulnerability is fixed in 25.04.702.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CollaboraOnline | online | < 25.04.702 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U