CVE-2025-66208

Name of the Vulnerable Software and Affected Versions Collabora Online - Built-in CODE Server versions prior to 25.04.702

Description A configuration-dependent Remote Code Execution (RCE) exists in the richdocumentscode proxy. This issue allows OS command injection, where an attacker can execute arbitrary operating system commands on the server. The flaw affects Nextcloud users utilizing the Collabora Online - Built-in CODE Server app when accessed via the proxy.php endpoint and an intermediate reverse proxy. A real-world incident was reported where a self-hosted Nextcloud instance was compromised because the reverse proxy trusted an insecure header.

Recommendations Update to version 25.04.702. Audit reverse proxy configurations to ensure they do not trust unauthorized headers.