CVE-2025-66208 is an OS command injection in the richdocumentscode proxy, the Collabora Online built-in CODE server used with Nextcloud. It depends on configuration, notably a reverse proxy in front of proxy.php. Fixed in 25.04.702. The record scores it 9.8, while the vendor advisory says Moderate.
What's affected
- Product: Collabora Online, Built-in CODE Server (richdocumentscode), as installed through Nextcloud.
- Affected: versions before 25.04.702.
- Fixed: 25.04.702.
- Not affected: the advisory says the typical default setup is unaffected, and a standalone dedicated Collabora Online server is unaffected.
Severity differs by source. The record gives CVSS 9.8 (critical), network reachable with no privileges. The vendor advisory rates it Moderate and describes it as configuration dependent. Both are worth stating: the worst case is severe, but you need the risky setup to get there.
How to check if you're exposed
In Nextcloud, open the Apps page and look at the version of Collabora Online, Built-in CODE Server. From the command line, you can list apps on the server.
sudo -u www-data php occ app:list | grep -i richdocumentscode
The app version should be 25.04.702 or later. Then review how Nextcloud is exposed. The advisory says the risk comes from use of a reverse proxy that insecurely trusts the X-Forwarded-Host header, so read your proxy config and check whether it passes that header through from clients.
What to do now
- Update the Built-in CODE Server app to 25.04.702 or later.
- Review reverse proxy configuration. Avoid insecurely trusting X-Forwarded-Host, as the advisory advises. Set the header at your own proxy and strip any copy a client sends.
- Consider moving to a standalone Collabora Online server, which the advisory says is unaffected.
- Check web server and Nextcloud logs for unexpected requests to proxy.php.
- Inventory the other apps in your Nextcloud install and scan their dependencies. Paste your manifests into the free in-browser scan at gold.safeguard.sh/scan to see which of your dependencies carry this CVE, and use reachability analysis to separate the services that actually call the affected code from the ones that only list the package.
Why it matters
The class is CWE-78, OS command injection. Input that reaches a shell command without safe handling can make the server run commands the operator never intended. Here the advisory ties it to proxy.php and to headers that an intermediate reverse proxy may trust.
The lesson is about trust boundaries. A forwarded host header is only trustworthy if your own edge sets it. When an application trusts it blindly, a single client can steer behavior that was meant to be internal. The record shows no known exploitation and the CVE is not on CISA KEV.
Quick check
Is the default Nextcloud plus Collabora setup affected?
The advisory says the typical default setup of the built-in CODE server is unaffected, but it still recommends updating to 25.04.702.
Why do the record and the advisory disagree on severity?
The record carries a CVSS 9.8 base score. The vendor rates it Moderate because the issue depends on a specific reverse proxy configuration.
Sources
Last reviewed: 18 October 2026.
