Collabora Online CVE-2025-66208

Exploitation requires a Nextcloud deployment with the 'Collabora Online - Built-in CODE Server' (richdocumentscode) app installed AND an intermediate reverse proxy sitting in front of it, with attacker-reachable requests flowing through proxy.php into the richdocumentscode proxy. The vendor explicitly labels this 'Configuration-Dependent,' and the CVSS 4.0 AT:P metric confirms a specific attack requirement must be met - so default or non-proxied installations are not necessarily vulnerable. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the dependence on the reverse-proxy topology is the primary limiting factor reducing real-world exposure; affected versions are richdocumentscode/online prior to 25.04.702.

This is a genuine but conditional threat. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes a network-reachable, unauthenticated flaw yielding full confidentiality, integrity and availability impact on the vulnerable system (VC:H/VI:H/VA:H) - consistent with an OS command injection (CWE-78) RCE. The score of 7.2 (High rather than Critical) is driven down by AT:P (Attack Requirements: Present), which directly reflects the vendor's own 'Configuration-Dependent' characterization: exploitation needs a specific deployment (Nextcloud running the Built-in CODE Server app behind an intermediate reverse proxy). Signals partially diverge: a public POC exists (referenced GitHub issue #354) and the flaw is unauthenticated RCE, yet the EPSS score is only 0.50% (66th percentile) and it is NOT on CISA KEV, indicating no evidence of widespread active exploitation - the low EPSS is plausibly explained by the non-default configuration prerequisite narrowing the exploitable population. Net: prioritize patching for any Nextcloud deployment matching the vulnerable topology, but this is not an indiscriminately wormable internet-wide emergency. The input provides a CVSS 4.0 vector but no CVSS 3.1 vector; no SSVC decision data was supplied.

A remote, unauthenticated attacker targets a Nextcloud instance that has the Collabora Online Built-in CODE Server (richdocumentscode) app installed and is fronted by an intermediate reverse proxy. The attacker sends crafted requests through proxy.php that reach the richdocumentscode proxy, injecting OS commands that execute on the server. Publicly available exploit code exists (referenced in the upstream GitHub issue), lowering the barrier for a prepared attacker, though success depends on the specific reverse-proxy configuration.