CVE-2025-66208: Collabora Online

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online. In versions prior to 25.04.702, Collabora Online has a Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy. Users of Nextcloud with Collabora Online - Built-in CODE Server app can be vulnerable to attack via proxy.php and an intermediate reverse proxy. This vulnerability is fixed in 25.04.702.

Affected products

• Collabora Online: before 25.04.702 (fixed in 25.04.702)

Published 2025-12-03. Last modified 2026-06-17.