CVE-2026-110447: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.
Other sources
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nextcloud richdocumentscode (Collabora Online Built-in CODE Server)to a version that resolves this vulnerability.Fixed in 26.4.303 - Compensating control
Discontinue use of the Collabora Online Built-in CODE Server product if mitigations are unavailable.
Event History
Frequently Asked Questions
Which deployments are affected?
Only Nextcloud deployments using the Collabora Online Built-in CODE Server through the richdocumentscode app are affected. Standalone Collabora Online servers are not affected.
When can an attacker trigger the command injection?
The vulnerable path is proxy.php when the CODE server is not running, such as after the product has recently restarted. This condition is specifically identified as enabling the OS command injection.
What version should be deployed to remediate the issue?
Update the richdocumentscode app to version 26.4.303 or later. Versions before 26.4.303 are affected.
Has this vulnerability been exploited?
Yes. It was exploited in the wild during September and October 2026.