Collabora Online Built-in CODE Server
CVE-2026-110447: command injection in the Collabora built-in CODE server.
The Collabora Online Built-in CODE Server before 26.4.303, the richdocumentscode app for Nextcloud, allows remote code execution through an OS command injection in proxy.php when the CODE server is not running, such as after a restart. A standalone Collabora Online server is not affected.
Exploitation
- Exploitation
- Exploited in the wild
- CISA KEV
- Listed 23 Oct 2026
- Federal due date 26 Oct 2026; catalogue read 31 Oct 2026
- EPSS
- 73% in 30 days
- Percentile 99%, scored 29 Oct 2026
- 9.2Critical, (CVSS 4.0)Scored by NVD
- 73%EPSS, chance of exploitation in 30 daysPercentile 99%; scored 29 Oct 2026
- 14 OctPublished by NVD14 Oct 2026; record read 26 Oct 2026
Versions
Affected and fixed.
.
| Affected | Fixed in |
|---|---|
| Collabora Online Built-in CODE Server before 26.4.303 | 26.4.303 |
What to do now
Update the richdocumentscode app to 26.4.303 or later on every Nextcloud instance and review the host for activity after a restart. The October list sits in our digest.
How to check exposure
In the app management view of Nextcloud the Collabora Online Built-in CODE Server version shows beside the app; anything below 26.4.303 is exposed. The NVD description notes exploitation in the wild in September and October 2026 and distinguishes this flaw from CVE-2025-66208. The Nextcloud announcement referenced from the NVD record carries the update notice.
A Nextcloud instance with the built-in server and a public address is the exposed shape; a standalone Collabora deployment is not in scope.
Who this reaches in Australia
Nextcloud with the built-in CODE server is the self-hosted document platform of Australian associations, schools and firms that chose to keep files on their own server rather than in a hosted suite. The flaw turns that choice into a command injection on the host whenever the server component restarts.
Under the Essential Eight the fix is patch applications for an internet-facing service within 48 hours, and application control on the host limits what an injected command can run.
Timeline
Disclosed, published, listed, advised.
- : Published by NVD
- : Added to the CISA Known Exploited Vulnerabilities Catalog
- : CISA due date for US federal agencies
- : NVD record last modified
Questions, answered.
Is CVE-2026-110447 exploited?
Yes. The NVD description records exploitation in the wild in September and October 2026, and CISA added it to the Known Exploited Vulnerabilities Catalog on 23 October 2026 with a 26 October due date.
Is standalone Collabora Online affected?
No. The NVD description states the vulnerability is not present in standalone Collabora Online servers; only the built-in CODE server deployment inside Nextcloud is affected.
Which release fixes it?
Collabora Online Built-in CODE Server 26.4.303. The app updates through the app management view of Nextcloud.
Provenance
Sources, and when they were read.
Every source was read 31 Oct 2026.
- 1NVD, CVE-2026-110447NIST. US Government work, public domain.
- 2CISA, Known Exploited Vulnerabilities CatalogUS Government work, public domain.
- 3FIRST, EPSS score for CVE-2026-110447EPSS terms of use.
- 4Black Shard, Essential Eight assessment
- 5Black Shard, Exploited in October 2026: Ivanti, Windows, PAN-OS, Cisco and Ahsay lead 26 additions
- 6Vendor reference for CVE-2026-110447: github.comgithub.com. terms of use.