Summary
A critical unauthenticated remote code execution vulnerability in the Collabora Online Built-in CODE Server app (richdocumentscode) allows an attacker to execute arbitrary OS commands on the host server through an exposed reverse proxy endpoint. CVE-2025-66208 carries a CVSS 3.1 base score of 9.8, requires no credentials and no user interaction, and is rated automatable by CISA. A patch is available. No confirmed exploitation has been reported.
Timeline
| Date | Event |
|---|---|
| Dec 3, 2025 | CVE-2025-66208 disclosed. Fix available in Collabora Online Built-in CODE Server (richdocumentscode) version 25.04.702. |
| Oct 15, 2026 | No confirmed exploitation in the wild; CISA SSVC rates exploitation as none. Advisory included in TTO digest given CVSS 9.8 and automatable exploitation path. |
What Happened
CVE-2025-66208 is an OS command injection weakness (CWE-78) in the proxy component of richdocumentscode, the built-in Collabora Online CODE Server distributed as a Nextcloud app. The vulnerable endpoint is proxy.php, which is reachable through an intermediate reverse proxy in standard Nextcloud deployments that use the built-in Collabora integration. Because the flaw is pre-authentication and fully automatable, a network-adjacent or internet-facing attacker can send a crafted request to the proxy endpoint and achieve OS-level command execution on the underlying server without any prior access or victim interaction.
All versions of the Nextcloud Collabora Online — Built-in CODE Server app (richdocumentscode) prior to 25.04.702 are affected. Deployments using an external Collabora Online server rather than the built-in app are not affected by this specific flaw. Nextcloud instances with the built-in integration enabled expose the richdocumentscode reverse proxy as part of their standard configuration, and the proxy endpoint does not require authentication by design.
No public proof-of-concept code has been observed as of this writing. The combination of a 9.8 CVSS score and no-interaction exploitation path makes this a high-priority candidate for rapid weaponization once a PoC circulates. Administrators should update the app to 25.04.702 immediately via the Nextcloud app store or the occ app:update command. If immediate patching is not possible, restrict network access to the Nextcloud instance at the perimeter and disable the built-in CODE Server app until the update can be applied.
Domain Intelligence
nextcloud.com — 62.00 / D
nextcloud.com scores in the low-trust range. Nextcloud is the self-hosted collaboration platform whose built-in Collabora integration exposes the vulnerable richdocumentscode proxy endpoint in affected deployments.