CollaboraOnline vulnerabilities
We track 4 vulnerabilities in CollaboraOnline products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on December 3, 2025.
Latest CollaboraOnline vulnerabilities
- 9.8 Critical severity
online: Improper Neutralization of Special Elements used in an OS Command
Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online. In versions prior to 25.04.702, Collabora Online has a Configuration-Dependent RCE (OS Command Injection) in r
- 8.3 High severity
online: Relative Path Traversal
Collabora Online is a collaborative online office suite based on LibreOffice technology. In versions prior to 24.04.12.4, 23.05.19, and 22.05.25, there is a path traversal flaw in handling the CheckFileInfo BaseFileName field returned from WOPI servers. This a
- 8.2 High severity
online: Improper Certificate Validation
Collabora Online is a collaborative online office suite based on LibreOffice. In affected versions of Collabora Online, https connections from coolwsd to other hosts may incompletely verify the remote host's certificate's against the full chain of trust. This
- 7.2 High severity
online: Improper Limitation of a Pathname to a Restricted Directory
Collabora Online is a collaborative online office suite based on LibreOffice technology. Unlike a standalone dedicated Collabora Online server, the Built-in CODE Server (richdocumentscode) is run without chroot sandboxing. Vulnerable versions of the richdocume