Collabora Online Built In Code Server
Monthly
Unauthenticated OS command injection in the Collabora Online Built-in CODE Server Nextcloud app (richdocumentscode) before 26.4.303 allows remote attackers to execute arbitrary commands on the Nextcloud host via proxy.php, but only while the bundled CODE server process is not running - the window right after a restart, during startup, or following a crash. The CVSS 4.0 score is 9.2 and the CVE record attributes exploitation during September and October 2026, making this a genuine high-priority issue rather than a paper-tiger high-severity finding; the practical barrier is timing, not authentication, since the CVSS vectors carry PR:N/UI:N and an attacker can simply poll the endpoint until CODE is down. Standalone Collabora Online servers do not ship proxy.php and are explicitly not affected - the exposure is confined to Nextcloud instances with the richdocumentscode app, and the flaw is distinct from CVE-2025-66208.
Unauthenticated OS command injection in the Collabora Online Built-in CODE Server Nextcloud app (richdocumentscode) before 26.4.303 allows remote attackers to execute arbitrary commands on the Nextcloud host via proxy.php, but only while the bundled CODE server process is not running - the window right after a restart, during startup, or following a crash. The CVSS 4.0 score is 9.2 and the CVE record attributes exploitation during September and October 2026, making this a genuine high-priority issue rather than a paper-tiger high-severity finding; the practical barrier is timing, not authentication, since the CVSS vectors carry PR:N/UI:N and an attacker can simply poll the endpoint until CODE is down. Standalone Collabora Online servers do not ship proxy.php and are explicitly not affected - the exposure is confined to Nextcloud instances with the richdocumentscode app, and the flaw is distinct from CVE-2025-66208.