PT-2025-48979 · Collabora+1 · Code-Server+2

Published 2025-12-03 · Updated 2025-12-31 · CVE-2025-66208

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Collabora Online - Built-in CODE Server versions prior to 25.04.702

Description Collabora Online - Built-in CODE Server, which provides document editing features, contains a configuration-dependent Remote Code Execution (RCE) issue in the richdocumentscode proxy. Nextcloud users utilizing the Collabora Online - Built-in CODE Server app may be at risk through the proxy.php file and an intermediate reverse proxy. The issue allows for OS Command Injection.

Recommendations Update to version 25.04.702 or later.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-66208

GHSA-J3Q6-Q5PC-V5WF

Affected Products

Code-Server

Collabora Online

Nextcloud

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66208.json · Exploit
• https://github.com/CollaboraOnline/online/security/advisories/GHSA-j3q6-q5pc-v5wf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66208 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66208 · Security Note
• https://twitter.com/VulmonFeeds/status/1996375059246579828 · Twitter Post
• https://twitter.com/CVEnew/status/1996291986760822849 · Twitter Post
• https://twitter.com/SecReportCVE/status/2006379885040717968 · Twitter Post
• https://twitter.com/SecAideInfo/status/1997248255076278544 · Twitter Post
• https://t.me/CVEtracker/38778 · Telegram Post