CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2025-12-03
Collabora Online Built-in CODE Server (richdocumentscode) Proxy OS Command Injection and Remote Code Execution (RCE) Vulnerability (CVE-2025-66208)
[Affected Scope] Nextcloud deployments utilizing the Collabora Online - Built-in CODE Server (richdocumentscode) app prior to version 25.04.702
[Impact] Unauthenticated attackers can exploit a configuration-dependent OS Command Injection vulnerability via proxy.php and an intermediate reverse proxy to achieve Remote Code Execution (RCE)
[Mitigation] Immediately upgrade the richdocumentscode application to version 25.04.702 or later, and restrict external access to the proxy endpoint in the interim