CollaboraOnline online vulnerabilities

12 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Exploited CollaboraOnline online vulnerabilities

CVE-2026-110447 — Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

CVE-2026-110447 — Collabora Online – Built-in CODE Server OS Command Injection Vulnerability (CVSS 9.8) — exploited
CVE-2026-23623 — Collabora Online vulnerable to Authorization Bypass (CVSS 5.3)
CVE-2025-66208 — Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy (CVSS 9.8)
CVE-2025-27791 — Collabora Online Vulnerable to Arbitrary File Write (CVSS 8.3)
CVE-2025-24796 — Remote Code Execution within Collabora Online jail with Macros Enabled (CVSS 6.3)
CVE-2024-45045 — JavaScript Injection via url encoded values in links in Collabora Office Android (CVSS 6.1)
CVE-2024-37311 — Collabora Online's remote host TLS certificates are not fully verified (CVSS 8.2)
CVE-2024-25114 — Sensitive Information Disclosure (JailID) to users in Collabora Online (CVSS 5.3)
CVE-2023-31145 — Reflected XSS vulnerability in CollaboraOnline (CVSS 6.1)
CVE-2021-43817 — Reflected Cross-Site-Scripting vulnerability in Collabora Online (CVSS 6.1)
CVE-2021-32745 — Reflected Cross-Site-Scripting vulnerability (CVSS 6.1)
CVE-2021-32744 — Unauthenticated attacker could gain access to currently open files (CVSS 7.5)