CVE-2025-66208: 
NixOS vulnerability analysis and mitigation

CVE-2025-66208 is a Configuration-Dependent Remote Code Execution (RCE) vulnerability via OS Command Injection in the Collabora Online Built-in CODE Server (richdocumentscode) proxy component. It affects all versions of richdocumentscode prior to 25.04.702 and was disclosed on December 3, 2025. The vulnerability is exploitable through proxy.php in conjunction with an intermediate reverse proxy that insecurely trusts the X-Forwarded-Host header. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 7.2 (High) (GitHub Advisory, Red Hat CVE).

The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning user-controlled input is passed unsanitized to an OS-level command interpreter (GitHub Advisory). The attack vector is network-based, requiring no authentication or user interaction, but is configuration-dependent: exploitation requires a reverse proxy that insecurely trusts the X-Forwarded-Host HTTP header forwarded to proxy.php. The default standalone setup of richdocumentscode and dedicated Collabora Online server deployments are not affected; only Nextcloud deployments using the Built-in CODE Server app with a misconfigured intermediate reverse proxy are vulnerable (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary operating system commands on the host running the Collabora Online Built-in CODE Server, potentially resulting in complete system compromise. This includes unauthorized access to sensitive data, modification or destruction of files, installation of malware or backdoors, and full service disruption. Given that the affected component is typically integrated with Nextcloud, exploitation could also expose documents and user data stored within the Nextcloud instance (GitHub Advisory, Red Hat CVE).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.49%, indicating a currently low probability of exploitation in the near term. The CVSSv4 exploit maturity is rated "UNREPORTED," and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was discovered and reported by researcher "solonbughuntbh" (GitHub Advisory).

1. Reconnaissance: Identify Nextcloud instances that have the Collabora Online Built-in CODE Server (richdocumentscode) app installed and are running versions prior to 25.04.702, using tools like Shodan or Censys to find exposed Nextcloud deployments.
2. Identify reverse proxy configuration: Determine whether the target deployment uses an intermediate reverse proxy (e.g., nginx, Apache) that forwards and trusts the X-Forwarded-Host header to the Collabora Online proxy endpoint.
3. Craft malicious request: Send an HTTP request to the proxy.php endpoint with a manipulated X-Forwarded-Host header containing OS command injection payloads (e.g., shell metacharacters or command separators) designed to be interpreted by the server-side command execution context.
4. Achieve RCE: If the reverse proxy passes the injected header value unsanitized to an OS command, arbitrary commands execute on the server as the Collabora/Nextcloud service account, enabling reverse shell establishment, data exfiltration, or further lateral movement (GitHub Advisory).

• Network: Unusual or malformed HTTP requests to /proxy.php with suspicious X-Forwarded-Host header values containing shell metacharacters (e.g., ;, |, `, $(), &&); unexpected outbound connections from the Collabora/Nextcloud server to external IPs.
• Logs: Web server or Nextcloud access logs showing requests to proxy.php with anomalous or encoded X-Forwarded-Host values; error logs indicating unexpected command execution or process spawning.
• Process: Unusual child processes spawned by the Collabora Online or PHP process (e.g., /bin/sh, bash, curl, wget, python, nc) not consistent with normal document editing operations.
• File System: New or modified files in the Nextcloud or Collabora Online installation directories, particularly web shells, cron jobs, or scripts created by the service account.

The vulnerability is fixed in Collabora Online Built-in CODE Server (richdocumentscode) version 25.04.702; all affected users should upgrade immediately (GitHub Advisory). As a workaround, avoid using reverse proxy configurations that insecurely trust the X-Forwarded-Host header when forwarding requests to the Collabora Online proxy. Deployments using the default "Collabora Online - Built-in CODE Server" setup without an intermediate reverse proxy, or using a standalone dedicated Collabora Online server, are not affected and do not require immediate action. Additionally, implementing network segmentation to limit external access to the proxy endpoint and monitoring for suspicious activity are recommended interim measures.

The vulnerability was rated "Moderate" severity by the Collabora Online project on GitHub, despite the CVSS v3.1 score of 9.8, reflecting the configuration-dependent nature of exploitation. Red Hat has also tracked the CVE in their security advisory database. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified at this time (GitHub Advisory, Red Hat CVE).