Collabora
Monthly
Unauthenticated OS command injection in the Collabora Online Built-in CODE Server Nextcloud app (richdocumentscode) before 26.4.303 allows remote attackers to execute arbitrary commands on the Nextcloud host via proxy.php, but only while the bundled CODE server process is not running - the window right after a restart, during startup, or following a crash. The CVSS 4.0 score is 9.2 and the CVE record attributes exploitation during September and October 2026, making this a genuine high-priority issue rather than a paper-tiger high-severity finding; the practical barrier is timing, not authentication, since the CVSS vectors carry PR:N/UI:N and an attacker can simply poll the endpoint until CODE is down. Standalone Collabora Online servers do not ship proxy.php and are explicitly not affected - the exposure is confined to Nextcloud instances with the richdocumentscode app, and the flaw is distinct from CVE-2025-66208.
Reflected HTML injection in Collabora Online's cool.html editor page allows an unauthenticated remote attacker to inject markup through the host_session_id query/form parameter, which was substituted without HTML encoding; exploitation requires inducing a victim to load a crafted URL. Script execution and theft of the session authentication token and page contents occur only when an effective Content Security Policy is absent, and coolwsd sends a CSP header by default, so realistic script-execution exploitation requires a reverse proxy that strips or fails to preserve that header. The issue affects coolwsd before 24.04.18 and before 25.04.11 and is fixed in those releases; no CISA KEV entry or public exploit code was identified at time of analysis, and the vendor rates it medium severity (NVD CVSS 3.1 base 4.7).
Improper authorization in Collabora KodExplorer up to version 4.52 allows remote unauthenticated attackers to bypass authentication via manipulation of the fileUpload parameter in the /app/controller/share.class.php endpoint, potentially enabling unauthorized file access or modification with low confidentiality, integrity, and availability impact. Publicly available exploit code exists; however, the attack requires high complexity and is described as difficult to execute in practice, limiting real-world exploitation despite public disclosure and vendor non-responsiveness.
Configuration-dependent OS command injection in Collabora Online's richdocumentscode proxy can let remote attackers execute commands on Nextcloud deployments that expose the proxy through an intermediate reverse proxy. Affected installations are Collabora Online/richdocumentscode versions prior to 25.04.702; public exploit code exists, but the provided data contains no CISA KEV confirmation of active exploitation and EPSS is low at 0.50% (66th percentile). Exploitation requires the specific Nextcloud plus richdocumentscode plus reverse-proxy topology, so default or non-proxied deployments are not necessarily vulnerable.
Collabora Online is a collaborative online office suite based on LibreOffice technology. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Collabora Online is a collaborative online office suite based on LibreOffice technology. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Collabora Online is a collaborative online office suite based on LibreOffice technology. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Collabora Online is a collaborative online office suite based on LibreOffice technology. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Collabora Online is a collaborative online office suite. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Collabora Online is a collaborative online office suite. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated OS command injection in the Collabora Online Built-in CODE Server Nextcloud app (richdocumentscode) before 26.4.303 allows remote attackers to execute arbitrary commands on the Nextcloud host via proxy.php, but only while the bundled CODE server process is not running - the window right after a restart, during startup, or following a crash. The CVSS 4.0 score is 9.2 and the CVE record attributes exploitation during September and October 2026, making this a genuine high-priority issue rather than a paper-tiger high-severity finding; the practical barrier is timing, not authentication, since the CVSS vectors carry PR:N/UI:N and an attacker can simply poll the endpoint until CODE is down. Standalone Collabora Online servers do not ship proxy.php and are explicitly not affected - the exposure is confined to Nextcloud instances with the richdocumentscode app, and the flaw is distinct from CVE-2025-66208.
Reflected HTML injection in Collabora Online's cool.html editor page allows an unauthenticated remote attacker to inject markup through the host_session_id query/form parameter, which was substituted without HTML encoding; exploitation requires inducing a victim to load a crafted URL. Script execution and theft of the session authentication token and page contents occur only when an effective Content Security Policy is absent, and coolwsd sends a CSP header by default, so realistic script-execution exploitation requires a reverse proxy that strips or fails to preserve that header. The issue affects coolwsd before 24.04.18 and before 25.04.11 and is fixed in those releases; no CISA KEV entry or public exploit code was identified at time of analysis, and the vendor rates it medium severity (NVD CVSS 3.1 base 4.7).
Improper authorization in Collabora KodExplorer up to version 4.52 allows remote unauthenticated attackers to bypass authentication via manipulation of the fileUpload parameter in the /app/controller/share.class.php endpoint, potentially enabling unauthorized file access or modification with low confidentiality, integrity, and availability impact. Publicly available exploit code exists; however, the attack requires high complexity and is described as difficult to execute in practice, limiting real-world exploitation despite public disclosure and vendor non-responsiveness.
Configuration-dependent OS command injection in Collabora Online's richdocumentscode proxy can let remote attackers execute commands on Nextcloud deployments that expose the proxy through an intermediate reverse proxy. Affected installations are Collabora Online/richdocumentscode versions prior to 25.04.702; public exploit code exists, but the provided data contains no CISA KEV confirmation of active exploitation and EPSS is low at 0.50% (66th percentile). Exploitation requires the specific Nextcloud plus richdocumentscode plus reverse-proxy topology, so default or non-proxied deployments are not necessarily vulnerable.
Collabora Online is a collaborative online office suite based on LibreOffice technology. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Collabora Online is a collaborative online office suite based on LibreOffice technology. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Collabora Online is a collaborative online office suite based on LibreOffice technology. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Collabora Online is a collaborative online office suite based on LibreOffice technology. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Collabora Online is a collaborative online office suite. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Collabora Online is a collaborative online office suite. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.