Collabora Online Built-in CODE Server - RCE (CVE-2026-110447)
Description
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
psychologyCrowdSec Analysis
CVE-2026-110447 is a critical OS command injection vulnerability in the Collabora Online Built-in CODE Server Nextcloud app (richdocumentscode) before version 26.4.303. When the CODE server is not running, unauthenticated remote attackers can exploit proxy.php to execute commands on the host, potentially compromising its confidentiality, integrity, and availability; standalone Collabora Online servers are not affected. This vulnerability has reportedly been exploited in the wild.
CrowdSec has been tracking this vulnerability and its exploits since 29th of October 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-110447 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers target /apps/richdocumentscode/proxy.php or /apps/richdocumentscode_arm64/proxy.php, using a traversal-style URL and shell command substitution in the request path to attempt OS command execution. The exploit request commonly includes a status query parameter and a command that makes an outbound callback.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-10-14 |
| CISA KEV | 2026-10-23 |
| CISA Remediation Deadline | 2026-10-26 |
| Rule Released | 2026-10-29 |