Read the docs
TI-2025-40711 Aliases CVE-2025-66208

Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy

Priority MEDIUM 43CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online. In versions prior to 25.04.702, Collabora Online has a Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy. Users of Nextcloud with Collabora Online - Built-in CODE Server app can be vulnerable to attack via proxy.php and an intermediate reverse proxy. This vulnerability is fixed in 25.04.702.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01833 79th percentileScored 2026-11-07
Fix Fixed online (CollaboraOnline): 25.04.702

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Collaboraonlinebefore 25.04.70225.04.702Patch availableCNA
  • online VendorCollabora Affected before 25.04.702 Fixed in 25.04.702 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:collabora:collabora_online_-_built-in_code_server:*:*:*:*:*:nextcloud:*:*before 25.4.702VulnerableCollabora
  • cpe:2.3:a:collabora:collabora_online_-_built-in_code_server:*:*:*:*:*:nextcloud:*:* Versions before 25.4.702 Vulnerable ·Collabora

Remediation

  • Fix · CNA online (CollaboraOnline) Fixed in 25.04.702

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66208

References

Patch 1

  • TI-2026-73868 Collabora Online Built-in CODE Server allows remote code execution KEVCVSS 4.0CRITICAL 9.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences