Collabora vulnerabilities

Products

• online 6
• Collabora Online - Built-in CODE Server 2
• KodExplorer 1

Latest Collabora CVEs

Newest publication first

1. CVE-2026-110447 Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerabil...

   Published 2026-10-14

   Critical·CVSS 9.2 EPSS 73.3% CISA KEV added 2026-10-23 Exploited in the wild

   Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the C...

2. CVE-2026-6572 Collabora KodExplorer fileUpload Endpoint share.class.php improper authorization

   Published 2026-04-19

   Medium·CVSS 6.3 EPSS 0.32%

   A security vulnerability has been detected in Collabora KodExplorer up to 4.52. Affected by this issue is some unknown functionality of the file /app/controller/share.class.php of the component fileUpload Endpoint. The manipulation of the argument fileUpload leads to improper aut...

3. CVE-2025-66208 Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy

   Published 2025-12-03

   High·CVSS 7.2 EPSS 1.8%

   Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online. In versions prior to 25.04.702, Collabora Online has a Configuration-Dependent RCE (OS Command Injection) in richdocumentscode pro...

4. CVE-2024-45045 JavaScript Injection via url encoded values in links in Collabora Office Android

   Published 2024-08-29

   Medium·CVSS 6.1 EPSS 0.29%

   Collabora Online is a collaborative online office suite based on LibreOffice technology. In the mobile (Android/iOS) device variants of Collabora Online it was possible to inject JavaScript via url encoded values in links contained in documents. Since the Android JavaScript inter...

5. CVE-2024-25114 Sensitive Information Disclosure (JailID) to users in Collabora Online

   Published 2024-03-11

   Medium·CVSS 5.3 EPSS 0.47%

   Collabora Online is a collaborative online office suite based on LibreOffice technology. Each document in Collabora Online is opened by a separate "Kit" instance in a different "jail" with a unique directory "jailID" name. For security reasons, this directory name is randomly gen...

6. CVE-2023-31145 Reflected XSS vulnerability in CollaboraOnline

   Published 2023-05-15

   Medium·CVSS 6.1 EPSS 0.40%

   Collabora Online is a collaborative online office suite based on LibreOffice technology. This vulnerability report describes a reflected XSS vulnerability with full CSP bypass in Nextcloud installations using the recommended bundle. The vulnerability can be exploited to perform a...

7. CVE-2021-43817 Reflected Cross-Site-Scripting vulnerability in Collabora Online

   Published 2021-12-13

   Medium·CVSS 6.1 EPSS 0.67%

   Collabora Online is a collaborative online office suite based on LibreOffice technology. In affected versions a reflected XSS vulnerability was found in Collabora Online. An attacker could inject unescaped HTML into a variable as they created the Collabora Online iframe, and exec...

8. CVE-2021-32745 Reflected Cross-Site-Scripting vulnerability

   Published 2021-07-21

   Medium·CVSS 6.1 EPSS 0.60%

   Collabora Online is a collaborative online office suite. A reflected XSS vulnerability was found in Collabora Online prior to version 6.4.9-5. An attacker could inject unescaped HTML into a variable as they created the Collabora Online iframe, and execute scripts inside the conte...

9. CVE-2021-32744 Unauthenticated attacker could gain access to currently open files

   Published 2021-07-21

   High·CVSS 7.5 EPSS 1.1%

   Collabora Online is a collaborative online office suite. In versions prior to 4.2.17-1 and version 6.4.9-5, unauthenticated attackers are able to gain access to files which are currently opened by other users in the Collabora Online editor. For successful exploitation the attacke...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.