CVE-2026-110447: OS Command Injection
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Only Nextcloud deployments using the Collabora Online Built-in CODE Server through the richdocumentscode app are affected. Standalone Collabora Online servers are not affected.
When can an attacker trigger the command injection?
The vulnerable path is proxy.php when the CODE server is not running, such as after the product has recently restarted. This condition is specifically identified as enabling the OS command injection.
What version should be deployed to remediate the issue?
Update the richdocumentscode app to version 26.4.303 or later. Versions before 26.4.303 are affected.
Has this vulnerability been exploited?
Yes. It was exploited in the wild during September and October 2026.