CVE-2026-110447 in Online
Summary
by MITRE • 10/15/2026
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The Collabora Online Built-in CODE Server, specifically versions prior to 26.4.303 within the richdocumentscode Nextcloud application ecosystem, contains a critical operating system command injection vulnerability that enables remote code execution. This flaw was actively exploited in the wild during September and October of 2026, marking it as a significant threat vector for organizations relying on this specific deployment architecture. It is crucial to distinguish this incident from CVE-2025-66208, which represents a separate vulnerability; conflating the two could lead to incomplete remediation strategies or misattribution of attack vectors in forensic analyses. The existence of active exploitation underscores the urgency for immediate patching and security posture review among affected deployments.
The technical root cause lies within the proxy.php component when the CODE server process is not currently running, a state that frequently occurs after product restarts or during initial boot sequences where service dependencies have not yet fully initialized. In this specific operational window, the application fails to properly sanitize input parameters before passing them to underlying system commands. This lack of validation allows an attacker to inject arbitrary operating system commands into the execution pipeline. The vulnerability is strictly confined to deployments utilizing the Built-in CODE Server architecture and does not affect standalone Collabora Online server installations, highlighting that the flaw is intrinsic to how Nextcloud manages its embedded service dependencies rather than a fundamental issue with the Collabora Office suite itself.
From an operational impact perspective, successful exploitation results in full remote code execution on the host system running the vulnerable software. An attacker can leverage this capability to compromise the underlying operating system, potentially leading to data exfiltration, lateral movement within the network, or complete service disruption through destructive commands. The fact that this vulnerability is triggered when the CODE server is not running suggests a race condition or state management flaw where fallback mechanisms or error handling routines bypass security controls intended for normal operation. This creates a narrow but exploitable window of opportunity for attackers who can trigger restarts or detect periods of unavailability to launch their attacks.
This incident aligns with CWE-78, which defines Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The attack vector is consistent with MITRE ATT&CK technique T1059, specifically sub-techniques involving command and scripting interpreter abuse such as T1059.004 for Unix Shell or T1059.007 for PowerShell if applicable to the environment. Defenders should recognize that this vulnerability exploits a specific architectural dependency rather than a general application logic flaw, which necessitates targeted mitigation strategies focused on service management and input validation within the proxy layer.
To mitigate this risk, organizations must immediately upgrade the richdocumentscode package to version 26.4.303 or later, where the command injection vector in proxy.php has been addressed through rigorous input sanitization and improved state handling during server startup sequences. Until patching is complete, administrators should consider implementing network-level access controls that restrict connectivity to the Nextcloud instance from untrusted networks, particularly targeting the endpoints associated with the CODE service. Additionally, monitoring for unusual process creation events or command-line arguments containing suspicious characters can aid in detecting attempted exploitation of this vulnerability during periods when services are restarting or recovering from downtime.