What’s Vulnerable › Vulnerabilities
CVE-2026-110447: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2026-10-23
- EPSS: 12.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-14 · updated 2026-10-26
- Weakness: CWE-78
Description
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
Summary
CVE-2026-110447 is a critical OS command injection (CVSS 9.8) in proxy.php of the Collabora Online Built-in CODE Server Nextcloud app (richdocumentscode), triggered when the CODE server isn't running, such as after a recent restart. It allows remote code execution and has been actively exploited in the wild in September and October 2026; it is listed in CISA's Known Exploited Vulnerabilities catalog. Only this Nextcloud deployment with CODE Server is affected — standalone Collabora Online servers are not — and it is fixed in 26.4.303. Apply the vendor mitigations and update to 26.4.303, following CISA BOD 26-04 guidance, and discontinue use if mitigations are unavailable.
CVE-2026-110447 هو ثغرة حقن أوامر نظام التشغيل خطيرة (CVSS 9.8) في الملف proxy.php ضمن تطبيق Collabora Online Built-in CODE Server الخاص بـ Nextcloud (richdocumentscode)، وتُستغل عند توقف خادم CODE، كما يحدث بعد إعادة التشغيل مؤخراً. تتيح الثغرة تنفيذ تعليمات برمجية عن بُعد، وقد جرى استغلالها فعلياً في البرية خلال شهري سبتمبر وأكتوبر 2026، وهي مدرجة في كتالوج CISA للثغرات المعروفة المستغلة. يقتصر التأثر على نشر Nextcloud هذا مع CODE Server، ولا تشمل خوادم Collabora Online المستقلة، وقد أُصلحت الثغرة في الإصدار 26.4.303. طبّق إجراءات التخفيف وفق تعليمات المورّد وحدّث إلى الإصدار 26.4.303 مع الالتزام بتوجيهات CISA BOD 26-04، وتوقف عن استخدام المنتج إذا لم تتوفر إجراءات التخفيف.
Affected products
- CollaboraOnline online: before 26.4.303 — fixed in 26.4.303
- Collabora Online - Built-in CODE Server: before 26.4.303 — fixed in 26.4.303
How to fix
Upgrade to a fixed version: CollaboraOnline online 26.4.303; Collabora Online - Built-in CODE Server 26.4.303. Check the vendor advisory for mitigations.
In the news
References
- https://github.com/CollaboraOnline/richdocumentscode/issues/354
- https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110447
Get alerted when CVE-2026-110447 or the next vulnerability affects your stack