Users of Nextcloud with Collabora Online - Built-in CODE Server app can be vulnerable through proxy.php. A request can cause an operating system command to run as the web server user.
The attack only works while the built-in CODE server is not running. So on a container restart, an upgrade, or after a crash. It is not sufficient to disable the app to avoid the problem, it must be upgraded to >= 26.4.303 or removed.
Users of EOL Nextcloud <= 29 should upgrade their Nextcloud or remove this app.
Standalone Collabora Online servers are not affected.
This is not the same path as CVE-2025-66208, and the fix for that issue does not prevent it.
The bug was fixed in Collabora Online - Built-in CODE Server (richdocumentscode) release 26.4.303.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
