Description (CNA)
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Collabora / Collabora Online - Built-in CODE Server | affected 0 before 26.4.303 |
CWE
CWE-78
References
- https://github.com/CollaboraOnline/richdocumentscode/issues/354
- https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516
ADP enrichment
No English description supplied.