Collabora Online – Built-in CODE Server Configuration-Dependent RCE Vulnerability (CVE-2025-66208) — CRITICAL Severity

Overview

In the ever-evolving landscape of digital security, a critical vulnerability, identified as CVE-2025-66208, has surfaced, impacting users of Collabora Online’s Built-in CODE Server when integrated with Nextcloud. This isn’t just a minor glitch; it’s a significant security flaw that could allow unauthorized individuals to execute commands directly on the server’s operating system. Such a compromise, known as Remote Code Execution (RCE), can lead to complete control over the affected system, enabling data theft, system disruption, or further network penetration. For IT administrators, developers, and tech-savvy users managing Nextcloud environments, understanding this vulnerability and applying timely remediation is paramount to safeguarding their digital assets.

CVE Details

This specific security flaw targets the Collabora Online – Built-in CODE Server, often referred to by its package name, richdocumentscode. This component is designed to provide powerful document editing capabilities directly within the Nextcloud platform.

• Product: Collabora Online – Built-in CODE Server (richdocumentscode)
• CVE ID: CVE-2025-66208
• Published Date: December 03, 2025
• Last Modified Date: October 30, 2026
• Severity: CRITICAL
• Status: Analyzed

Affected Products

The vulnerability specifically impacts instances of Collabora Online – Built-in CODE Server that are running prior to version 25.04.702. If you are using Nextcloud with the Collabora Online – Built-in CODE Server app, your setup could be at risk. The attack vector involves the proxy.php file and relies on an intermediate reverse proxy that may be configured to insecurely trust X-Forwarded-Host headers. It is crucial to note that standalone installations of the dedicated Collabora Online server are not affected by this particular issue, as the vulnerability is tied to its specific integration within Nextcloud.

Current Status

The vulnerability CVE-2025-66208 has been thoroughly analyzed, and its details are publicly available. Importantly, a patch has been developed and released to address the flaw. This means that while the threat is serious, a clear path to resolution exists, emphasizing the need for immediate action from affected organizations and individuals.

Severity Level

The official CVE assessment designates this vulnerability as CRITICAL, underscored by a CVSS score of 9.8. This is the highest possible severity rating, indicating that successful exploitation could lead to profound negative impacts, including the complete loss of confidentiality, integrity, and availability of the compromised system. Such vulnerabilities are typically easy to exploit and require little to no user interaction. While a GitHub advisory for this issue might list its severity as “Moderate,” the NVD’s CRITICAL rating should be considered the definitive measure of risk due to its comprehensive and standardized evaluation methodology.

Possible Solutions

Addressing this critical vulnerability is straightforward but requires prompt action:

• Immediate Update: The most effective solution is to upgrade your Collabora Online – Built-in CODE Server installation to version 25.04.702 or later. This patched version contains the necessary fixes to prevent exploitation of the configuration-dependent RCE. Ensure that your Nextcloud environment and all associated applications are kept up-to-date to benefit from the latest security enhancements.
• Review Reverse Proxy Configurations: If an immediate upgrade is not feasible, or as a complementary security measure, it is vital to review your reverse proxy configurations. The vulnerability specifically mentions exploitation via an intermediate reverse proxy that insecurely trusts X-Forwarded-Host headers. Ensure your reverse proxy is configured to sanitize or strictly validate incoming X-Forwarded-Host headers, preventing them from being manipulated by attackers to inject malicious commands. This involves ensuring that only trusted host headers are accepted and processed by your server.
• Network Segmentation: Implementing network segmentation can limit the blast radius if a system is compromised. Separating critical services and sensitive data can help contain an attack, even if a vulnerability is exploited.
• Regular Audits: Regularly audit your Nextcloud and Collabora Online configurations, as well as your network infrastructure, to identify and address potential security weaknesses before they can be exploited.

References

https://github.com/CollaboraOnline/online/security/advisories/GHSA-j3q6-q5pc-v5wf