CVE-2025-66208: Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy
Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online. In versions prior to 25.04.702, Collabora Online has a Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy. Users of Nextcloud with Collabora Online - Built-in CODE Server app can be vulnerable to attack via proxy.php and an intermediate reverse proxy. This vulnerability is fixed in 25.04.702.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66208?
CVE-2025-66208 has been classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2025-66208?
To mitigate CVE-2025-66208, upgrade to Collabora Online - Built-in CODE Server version 25.04.702 or later.
What is the impact of CVE-2025-66208?
CVE-2025-66208 allows attackers to execute operating system commands on the server through the richdocumentscode proxy.
Which versions are affected by CVE-2025-66208?
Versions of Collabora Online - Built-in CODE Server prior to 25.04.702 are affected by CVE-2025-66208.
Is there a workaround for CVE-2025-66208?
Currently, the recommended action for CVE-2025-66208 is to upgrade to the patched version, as there are no effective workarounds.