CVE-2025-66208 Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy Severity: Moderate CVE ID: CVE-2025-66208 Affected Versions Package: richdocumentscode (richdocumentscode) Affected Versions: < 25.04.702 Patched Versions Patched Versions: 25.04.702 Impact Users of Nextcloud with Collabora Online - Built-in CODE Server app can be vulnerable to attack via proxy.php and an intermediate reverse proxy. Patches The bug was fixed in Collabora Online - Built-in CODE Server (richdocumentscode) release 25.04.702. Workarounds The typical default setup of "Collabora Online - Built-in CODE Server" (richdocumentscode) is unaffected. But use of a reverse proxy that insecurely trusts X-Forwarded-Host should be avoided. Standalone dedicated Collabora Online server is unaffected. References Thanks to solonbughuntbh for discovering and reporting this vulnerability.