CVE-2026-110447

Deferred Deferred - Pending Action

Remote Code Execution in Collabora Online CODE Server

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: MITRE

Description

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110447

EUVD

EUVD-2026-100780

Affected Vendors & Products

Vendor	Product	Version / Range
Collabora	Collabora	Online - Built-in CODE Server 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is a critical OS command injection vulnerability in Collabora Online's Built-in CODE Server app for Nextcloud. It allows remote attackers to execute arbitrary shell commands on the server by exploiting a flaw in proxy.php when the CODE server is not running, such as after a restart. The vulnerability exists in versions up to v26.4.302 and enables attackers to create web shells and gain remote control over the web server.

The attack specifically targets the /apps/richdocumentscode/proxy.php?status endpoint using path traversal, command substitution, and Base64-encoded payloads to inject malicious commands.

Detection Guidance

Check for suspicious PHP files in the Nextcloud richdocumentscode directory, particularly files with names like shx*.php. Inspect network traffic for requests to /apps/richdocumentscode/proxy.php?status with unusual parameters. Review system logs for unexpected exec or shell command executions from the web server process.

Impact Analysis

If you are running the affected Nextcloud app (richdocumentscode v26.4.302 or earlier) in Built-in CODE Server mode, attackers can exploit this to execute arbitrary commands on your server. This could lead to full compromise of your Nextcloud instance, allowing attackers to install web shells, access sensitive files, and potentially exfiltrate or encrypt your data.

Attackers have reportedly installed web shells to gain persistent remote access, and have targeted cryptocurrency-related files and other sensitive data. Systems using Docker, Linux packages, or third-party hosting are not affected.

Compliance Impact

This vulnerability could lead to unauthorized access and potential data breaches, which would violate compliance requirements under GDPR and HIPAA. GDPR requires protection of personal data, and a breach could result in fines. HIPAA requires safeguarding protected health information, and unauthorized access would constitute a violation.

The full server compromise enabled by this flaw could expose regulated data, leading to legal penalties, reputational damage, and mandatory breach notifications depending on jurisdiction.

Mitigation Strategies

Immediately update the richdocumentscode app to version 26.4.303 or later. Remove any unauthorized PHP files, especially web shells. Disable the Built-in CODE Server if not in use. Ensure the web server runs with minimal privileges and review file permissions.

Hi! I’m here to help you understand CVE-2026-110447. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70