GHSA-j3q6-q5pc-v5wf: Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy
Published Dec 3, 2025
·Updated
Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online. In versions prior to 25.04.702, Collabora Online has a Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy. Users of Nextcloud with Collabora Online - Built-in CODE Server app can be vulnerable to attack via proxy.php and an intermediate reverse proxy. This vulnerability is fixed in 25.04.702.
Affected Software
1 affected component
Collabora Collabora Online - Built-in CODE Server<25.04.702
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Collabora Online - Built-in CODE Server (richdocumentscode)to a version that resolves this vulnerability.Fixed in 25.04.702
Event History
Dec 3, 2025
CVE Published
via OSV·06:25 PM
Data Sourced
via OSV·06:25 PM
DescriptionSeverityWeakness