Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in th
Only the Development Edition in Built-in CODE Server mode that downloads a local appimage, with richdocumentscode 26.4.302 or older, is in scope. Fixed in 26.4.303.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 26.4.303
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 2 proofs of concept on GitHub, 1 Nuclei template
- Exploitation: active
- Automatable: yes
- Technical impact: total
Summary
The built-in CODE Server in the Collabora Online app (richdocumentscode) for Nextcloud is affected. An attacker could run commands on the server remotely when the CODE Server is not running, such as after a restart; standalone Collabora Online servers are not affected.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: active · Automatable: yes · Technical impact: total
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
- CISA remediation deadline
Due date for US federal agencies to patch
Affected versions
- richdocumentscode
fixed in 26.4.303
References 5
GitHub · CollaboraOnline/richdocumentscode
help.nextcloud.com
GitHub · projectdiscovery/nuclei-templates
GitHub · CyRouteWolf/cve-2026-110447-poc
GitHub · adriyansyah-mf/cve-2026-110447
Questions about CVE-2026-110447
What does this mean?
Remote attackers can execute arbitrary OS commands on the affected system, potentially leading to full system compromise.Source: help.nextcloud.com, github.com, github.com
Am I affected, and how do I check?
The issue covers Collabora Online Built-in CODE Server before 26.4.303, with the richdocumentscode app at version 26.4.302 or older. It applies only to the Development Edition in the Built-in CODE Server mode that downloads a local appimage, and the attack requires the CODE server to be stopped. To check, look at the richdocumentscode app version in Nextcloud and at the Collabora edition and deployment mode.Source: help.nextcloud.com, github.com, github.com
What should I do about it?
Upgrade to Collabora Online Built-in CODE Server version 26.4.303 or later.Source: help.nextcloud.com, github.com, github.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-23, which means it has evidence of attacks. Public exploit code exists (a Nuclei template, a proof of concept on GitHub).Source: cisa.gov, cve.now feed data