{"schema":"threatline.record/2","record":{"id":"CVE-2025-66208","aliases":["GHSA-j3q6-q5pc-v5wf"],"summary":"Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy","details":"Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online. In versions prior to 25.04.702, Collabora Online has a Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy. Users of Nextcloud with Collabora Online - Built-in CODE Server app can be vulnerable to attack via proxy.php and an intermediate reverse proxy. This vulnerability is fixed in 25.04.702.","categories":["Unclassified"],"product":"online","vendor":"CollaboraOnline","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-66208","source_modified_at":"2025-12-03T18:51:19.697Z","fetched_at":"2026-10-26T12:48:13.248886Z","product":"online","vendor":"CollaboraOnline","versions":[{"version":"< 25.04.702","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":7.2,"severity":"High","kev":{"listed":false},"epss":{"probability":0.01833,"percentile":0.78759,"score_date":"2026-10-25"},"published_at":"2025-12-03T18:25:59.376Z","modified_at":"2025-12-03T18:51:19.697Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2025-66208","fetched_at":"2026-10-26T12:48:13.248886Z","source_modified_at":"2025-12-03T18:51:19.697Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-66208","fetched_at":"2026-10-26T12:48:13.248886Z","source_modified_at":"2026-10-25"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-j3q6-q5pc-v5wf","tags":["x_refsource_CONFIRM"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"total","assessed_at":"2025-12-03T18:51:09.547326Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2025-12-03T18:51:19.697Z","content_hash":"3d2ed931da9e4beb9ec72e3affac8a733934aea8c9bd69c2590c226b54db029a"}}