Vulnerability Description
Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online. In versions prior to 25.04.702, Collabora Online has a Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy. Users of Nextcloud with Collabora Online - Built-in CODE Server app can be vulnerable to attack via proxy.php and an intermediate reverse proxy. This vulnerability is fixed in 25.04.702.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Collabora | Online | < 25.04.702 |
Related Weaknesses (CWE)
References
- https://github.com/CollaboraOnline/online/security/advisories/GHSA-j3q6-q5pc-v5wPatchVendor Advisory
FAQ
What is CVE-2025-66208?
CVE-2025-66208 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online. In versions prior to 25.04.702, Collabora Online h...
How severe is CVE-2025-66208?
CVE-2025-66208 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-66208?
Check the references section above for vendor advisories and patch information. Affected products include: Collabora Online.