> ## Content Index
> Fetch the complete content index at: https://securexion.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# CVE-2026-110447: Collabora Online CODE Server Command Injection Enables Remote Code Execution
- URL: https://securexion.com/cve-2026-110447/
- Published: 2026-10-26T06:53:05.000Z
- Updated: 2026-10-26T06:53:05.000Z
- Description: Collabora Online Built-in CODE Server before version 26.4.303 is vulnerable to OS command injection in proxy.php when the CODE server is not running, allowing unauthenticated remote code execution. This flaw is actively exploited in production environments.
- Author: Securexion Team
- Tags: Vulnerability, Critical, Actively Exploited, #brief-2026-10-24

The Collabora Online richdocumentscode Nextcloud app versions before 26.4.303 contain an OS command injection vulnerability triggered when the embedded CODE server is down or restarting. An unauthenticated attacker can send specially crafted requests to proxy.php that execute arbitrary operating system commands with the privileges of the web server process. This vulnerability has been actively exploited in the wild since September 2026 and is distinct from CVE-2025-66208.

| CVE                       | CVE-2026-110447                                                              |
| ------------------------- | ---------------------------------------------------------------------------- |
| Severity                  | Critical (CVSS 9.2)                                                          |
| Actively exploited        | Yes, listed in CISA's Known Exploited Vulnerabilities catalog on 23 Oct 2026 |
| CISA remediation deadline | 26 Oct 2026                                                                  |
| Weakness                  | CWE-78 (OS command injection)                                                |
| Attack vector             | Network                                                                      |
| Privileges required       | None                                                                         |
| User interaction          | None                                                                         |
| Published                 | 14 Oct 2026                                                                  |

## How the attack works

When the CODE server is unavailable (e.g., after a restart), proxy.php processes requests without proper input validation. An attacker crafts a malicious request with command injection payloads in parameters that are passed unsanitized to system command execution functions. Because the expected CODE server is offline, error handling routes the request through a code path that executes the injected commands on the host system.

## Who is affected

Organizations deploying Collabora Online as a Nextcloud app with the built-in CODE server (richdocumentscode) in versions before 26.4.303\. Standalone Collabora Online server deployments are not affected by this specific vulnerability.

## How to check if you're exposed

- Confirm your Collabora Online deployment type: check if you are using the richdocumentscode Nextcloud app or standalone Collabora Online
- Check the richdocumentscode app version in the Nextcloud App Store or via Nextcloud admin panel; versions before 26.4.303 are vulnerable
- Search web server logs for unusual POST/GET requests to proxy.php with suspicious characters or command syntax (e.g., backticks, $(), pipes, semicolons)
- Monitor for unexpected child processes spawned by the web server or PHP process, particularly around CODE server restart events

## How to fix it

- Upgrade Collabora Online richdocumentscode to version 26.4.303 or later via the Nextcloud App Store or manual update
- Restart the Nextcloud instance and verify the CODE server starts without errors
- Review web server and system logs for evidence of exploitation before the patch was applied

## If you can't patch yet

- Restrict network access to the Nextcloud instance and proxy.php to trusted users only using firewall rules or reverse proxy authentication
- Disable the richdocumentscode app temporarily until the patch can be applied; use an alternative document editor or standalone Collabora Online if available
- Monitor CODE server status and restart it regularly during low-traffic windows to minimize the window when proxy.php is vulnerable

---

*Need help checking your exposure or patching at scale?* [*FutureOps InfoTech*](https://futureopstech.com/?ref=securexion.com) *can help.*