Source: cisa.gov
Collabora Online's Built-in CODE Server contains an OS command injection vulnerability when used within the Nextcloud platform. The flaw allows remote code execution when the CODE server is not running. The vulnerability affects the integration between Collabora Online and Nextcloud, posing significant risk to users of this combination. CISA has flagged this under BOD 26-04, requiring prioritized security updates. Users are urged to update their Collabora Built-in CODE Server as soon as possible. The advisory is backed by both GitHub security advisories and NVD documentation. Forensics triage requirements have also been outlined under BOD 26-04 implementation guidance.
