Collabora Online Built-in CODE Server OS command injection enables remote code execution (CVE-2026-110447)

What happened

CVE-2026-110447 is an OS command injection flaw in proxy.php in the Collabora Online Built-in CODE Server, which is deployed as a Nextcloud app. When the CODE server is not running — for example, shortly after the product has been restarted — an unauthenticated attacker can send a crafted request over the network and execute operating system commands. No user interaction or prior access is required. The vulnerability does not affect standalone Collabora Online servers; only this built-in CODE Server deployment is affected.

Exploitation is active. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 23 October 2026, CISA's SSVC assessment marks exploitation as active, and ENISA EUVD records exploitation since 23 October 2026. The CVE record notes that this is a different vulnerability than CVE-2025-66208.

Who is affected

Collabora Online - Built-in CODE Server versions before 26.4.303 are affected. The affected app is known as richdocumentscode and is used to provide document editing within Nextcloud. Organisations running the standalone Collabora Online server are not affected. If this Nextcloud app is present, treat the instance as affected until the built-in CODE Server is updated to 26.4.303.

What to do now

No vendor workaround is listed in the available references, so patching and containment are the priority.

1. Update the Collabora Online - Built-in CODE Server to version 26.4.303. This is the fixed release.
2. If patching is delayed, restrict network reachability of the Nextcloud instance, including proxy.php, to trusted networks or authenticated users.
3. Monitor the server for unexpected command or process activity, particularly after restarts or while the built-in CODE server is not running.

How to detect it

Check whether proxy.php on the Nextcloud instance is reachable from untrusted networks; an internet-exposed instance is the first condition to review. Because the injection occurs when the CODE server is not running, treat command or process activity on the server shortly after a restart or CODE server outage as suspicious. The public references do not include vendor-supplied indicators of compromise.

Beyond the patch

Because CISA KEV and ENISA EUVD record active exploitation, detection and response are the first line. Our Managed Detection & Response (MDR) can detect the post-exploitation activity that follows command injection, while Virtual CISO Services can help identify whether the Nextcloud instance and proxy.php are exposed to untrusted networks. Patch first, then close the exposure.