CVE-2025-66208: collabora online OS Command Injection

Vulnerability summary

CVE-2025-66208 is a critical (CVSS 9.8) OS Command Injection vulnerability in collabora online. EPSS estimates a 1.08% chance of exploitation in the next 30 days, higher than 64.7% of scored vulnerabilities.

Timeline

1. 03-12-2025
   PublishedVulnerability first disclosed.
2. 03-12-2025
   Last modifiedVulnerability information updated.

Description

Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online. In versions prior to 25.04.702, Collabora Online has a Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy. Users of Nextcloud with Collabora Online - Built-in CODE Server app can be vulnerable to attack via proxy.php and an intermediate reverse proxy. This vulnerability is fixed in 25.04.702.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.