Back to the CVE list
CVE-2025-66208

OS command injection in Collabora Online

CVSS score

9.8

EPSS probability

%1.1

Risk score

0.1

Published

10 mo ago

OverviewPublic Exploits (0)NewsroomVulnerability Timeline

Related Security News

Articles and analysis bulletins in which the press and security publications have covered this vulnerability:

The Hacker News14.10.2026

Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App

Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw

Read the full story

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2025-66208"