Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-110447: Collabora Online Built-in CODE Server lets attackers run code

CVE-2026-110447 · published 2 days ago

Summary

The Collabora Online app for Nextcloud that includes the built‑in CODE server (versions before 26.4.303) can be tricked into running any command you choose when the CODE service is not active. This means an attacker who can reach the server could take control of the system and access your data. Update the app to the latest version or disable the built‑in CODE server until you can apply the update.

What to do

Update collabora collabora online - built-in code server to version 26.4.303 or later.

Affected software

Vendor	Product	Affected versions
collabora	collabora online - built-in code server	< 26.4.303

Original advisory text

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.

References

https://github.com/CollaboraOnline/richdocumentscode/issues/354 Third Party Advisory
https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516 Vendor Advisory
https://apps.nextcloud.com URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-1104... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-110447 Vendor Advisory
https://github.com/CollaboraOnline/richdocumentscode Product

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.9 Critical

Exploitation

1% chance of attack within 30 days

Type

CWE-78OS Command Injection

Timeline

Published14 Oct 2026

Updated15 Oct 2026

First seen14 Oct 2026

Sources

CVE-2026-110447 · NVD

CVE-2026-110447 · MITRE

CVE-2026-110447 · OSV

Track software like this

Free during beta