CVE-2025-66208 Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy

What is CVE-2025-66208?

CVE-2025-66208 is a high-severity command injection vulnerability in CollaboraOnline online, published on 3 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online. In versions prior to 25.04.702, Collabora Online has a Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy. Users of Nextcloud with Collabora Online - Built-in CODE Server app can be vulnerable to attack via proxy.php and an intermediate reverse proxy. This vulnerability is fixed in 25.04.702.

Weakness: CWE-78

Which versions are affected by CVE-2025-66208?

It affects 1 product.

Products include Collabora Online.

How do I fix CVE-2025-66208?

No fix has been published for CVE-2025-66208 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-66208 being exploited?

There is no known exploitation of CVE-2025-66208 in the wild and no public exploit code.

Other vulnerabilities in CollaboraOnline online

• CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Exploited Critical 9.2
• CVE-2021-32744 Unauthenticated attacker could gain access to currently open files Critical 9.8
• CVE-2021-43817 Reflected Cross-Site-Scripting vulnerability in Collabora Online High 8.2
• CVE-2021-32745 Reflected Cross-Site-Scripting vulnerability High 7.3
• CVE-2024-45045 JavaScript Injection via url encoded values in links in Collabora Office Android Medium 6.3

Sources

• CVE record
• NVD
• OSV
• How this page is made