CVE-2025-66208

CRITICO 9.8CVE-2025-66208 · Published 03/12/2025 · updated 30/10/2026

In breve

CVE-2025-66208 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda collabora online - built-in code server (collabora).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.8%, superiore al 78.9% delle vulnerabilità.
Correzione: aggiornare a 25.4.702 o successiva.

Package	Affected versions	Patched versions
collabora online - built-in code server collabora	`< 25.4.702`	`25.4.702`

Description

Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online. In versions prior to 25.04.702, Collabora Online has a Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy. Users of Nextcloud with Collabora Online - Built-in CODE Server app can be vulnerable to attack via proxy.php and an intermediate reverse proxy. This vulnerability is fixed in 25.04.702.

References

CollaboraOnline/online security advisory · Patch

Altre vulnerabilità di collabora online - built-in code server

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free