Collabora Online – Built-in CODE Server OS Command Injection Vulnerability (CVE-2026-110447)

What is affected, what to do

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted).

The vulnerability is being actively exploited; treat it as a priority. Update Collabora Online - Built-in CODE Server to version 26.4.303. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Collabora Online - Built-in CODE Server lt *..26.4.303

Fixed in

• Collabora Online - Built-in CODE Server 26.4.303

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Patch now: Update the Nextcloud app richdocumentscode (Collabora Online – Built-in CODE Server) to version 26.4.303 or later, e.g. sudo -u www-data php occ app:update richdocumentscode. Confirm the installed version with occ app:list | grep richdocumentscode. A fix for CVE-2025-66208 does not cover this issue, because it is a separate vulnerability.
   • If you can't update right away: Disable the app with occ app:disable richdocumentscode. Online document editing stays unavailable until you patch or switch to a standalone Collabora server. Standalone Collabora Online servers are not affected.
   • Build an inventory: Find every Nextcloud instance with richdocumentscode or richdocumentscode_arm64 enabled. Include hosted and managed instances, test systems and departmental installs. Handle internet-facing instances first.
   • Hunt retroactively: Review web server logs back to September 2026 for hits on proxy.php under /apps/richdocumentscode/ or /custom_apps/richdocumentscode/ (see Detection). Pay particular attention to the periods right after web server, PHP-FPM or host restarts, since the CODE server isn't running during those windows.
   • On suspected compromise: Isolate the host and preserve evidence (memory image, webroot, /tmp, www-data crontabs). Then rotate every secret stored on the host: the DB password from config.php, secret, passwordsalt, LDAP and SMTP bind accounts, S3/object storage keys and app passwords.
2. 02

   Runbook step 2

   Mitigation layers

   • Architecture: Replace the built-in CODE server permanently with a separate Collabora Online server (its own VM or container, connected via the richdocuments app). That deployment model is not affected, and it removes the office stack from the Nextcloud host.
   • Reverse proxy / WAF: Until you patch, restrict */richdocumentscode/proxy.php to internal networks or VPN, e.g. nginx location ~ /richdocumentscode/proxy\.php { allow 10.0.0.0/8; deny all; }. Also add a ModSecurity/CRS rule that blocks shell metacharacters in the URI and body of requests to proxy.php: ;, |, `, $(, &&, plus URL-encoded forms such as %3B, %7C and %60.
   • Shrink the exposure window: The bug is only reachable while the CODE server is down. Perform web server and PHP-FPM restarts with external access blocked, and reopen access only after you have confirmed that the CODE process (coolwsd) is running.
   • Host hardening: Confine child processes of the web server user with AppArmor or SELinux. Mount writable paths noexec (/tmp, /var/tmp and the Nextcloud data directory).
   • Network segmentation: Apply egress filtering so the Nextcloud host can reach only required destinations (updates, app store, federation). This hampers reverse shells and payload downloads via curl/wget. Block lateral connections from the DMZ into internal zones.
3. 03

   Runbook step 3

   Detection rules

   • Web access logs: Look for requests to proxy.php under richdocumentscode whose query string or body contains shell metacharacters or their encodings. Example SPL: index=web uri_path="*richdocumentscode/proxy.php*" | regex uri_query="(%3B|%7C|%60|%24%28|;|\||\$\()". Also flag unfamiliar source IPs, request bursts right after restarts, and HTTP 200 responses with unusual sizes.
   • EDR / Sysmon for Linux (EID 1) / auditd: Watch for the process chain php-fpm/apache2/httpd → sh/bash/dash → curl, wget, nc, python*, perl, base64 running as www-data/apache. auditd rule: -a always,exit -F arch=b64 -S execve -F euid=33 -k web_exec. Allowlist the known legitimate launches of the CODE AppImage and coolwsd.
   • Sigma shape: logsource: product=linux, category=process_creation; selection: ParentImage|endswith: ['/php-fpm*','/apache2','/httpd'] and Image|endswith: ['/sh','/bash','/curl','/wget','/nc']; filter: CommandLine|contains: 'coolwsd'.
   • Filesystem / persistence: Watch for new .php files in the Nextcloud webroot or app directories, new www-data crontab entries, and executables in /tmp or /dev/shm. Verify integrity with occ integrity:check-core and occ integrity:check-app richdocumentscode.
   • Network (Zeek/Suricata): Flag new outbound connections from the Nextcloud host to unknown IPs on unusual ports. Also flag HTTP downloads of ELF or script files initiated by the web server with a curl or Wget user agent.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.

Source: pwn.watch, NVD (NIST), cvelistv5, CISA KEV Catalog, BSI CSAF, BSI WID Portal

Vendors and products

• Collabora Online

Weakness classes (CWE)

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

  Base

  The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

  Entry at MITRE CWE-78

References & sources

• github.comSecurity issue - Hack (richdocumentscode issue #354)Issue tracking, pwn-watch, Issue tracking
• help.nextcloud.comTo Collabora Built-in User: Update ASAPVendor advisory, pwn-watch, Vendor advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1104…government-resource, US government resource
• pwn.watchpwn.watch: Attackers backdoor Nextcloud servers through the Collabora Built-in CODE Server app (CVE-2026-110447)pwn-watch
• NVD (NIST)NVD: CVE-2026-110447pwn-watch
• github.comGHSA-g3vx-3m76-fghhpwn-watch
• GitHub Security AdvisoriesGHSA-f97p-r72q-64h2pwn-watch
• thehackernews.comHackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora's Built-in CODE Apppwn-watch
• bleepingcomputer.comHackers exploit Collabora RCE flaw to backdoor Nextcloud serverspwn-watch
• cisa.govCISA KEV: CVE-2026-110447pwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 26.10.2026Initial analysis by NVDNVD

   Newly listed as affected:

   • Collabora Online (before 26.4.303)

   CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

   New references:

   • https://github.com/CollaboraOnline/richdocumentscode/issues/354
   • https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516
   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110447
   Show 5 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   CVSS	added	—	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
   Product configuration	added	—	OR *cpe:2.3:a:collabora:online:*:*:*:*:*:nextcloud:*:* versions up to (excluding) 26.4.303
   Reference type	added	—	MITRE: https://github.com/CollaboraOnline/richdocumentscode/issues/354 Types: Issue Tracking
   Reference type	added	—	MITRE: https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516 Types: Vendor Advisory
   Reference type	added	—	CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110447 Types: US Government Resource

   Source identifier: nvd@nist.gov

2. 24.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	removed	{"id":"CVE-2026-110447","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T20:04:16.288937Z"}	—
   SSVC assessment	added	—	{"id":"CVE-2026-110447","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

3. 23.10.2026CISA KEV entry updated9119a7d8…

   4 individual changes: Date Added, Due Date, Required Action, Vulnerability Name

   Show 4 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Date Added	added	—	2026-10-23
   Due Date	added	—	2026-10-23
   Required Action	added	—	2026-10-23
   Vulnerability Name	added	—	2026-10-23

   Source identifier: 9119a7d8-5eab-497f-8521-727c672e3725

4. 23.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	removed	{"id":"CVE-2026-110447","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T19:31:58.092895Z"}	—
   SSVC assessment	added	—	{"id":"CVE-2026-110447","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T20:04:16.288937Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

5. 23.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110447
   Show 3 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110447
   SSVC assessment	removed	{"id":"CVE-2026-110447","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T18:42:48.080318Z"}	—
   SSVC assessment	added	—	{"id":"CVE-2026-110447","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T19:31:58.092895Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Linked advisories

• CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloudThe Hacker News24.10.2026
• Hackers exploit Collabora RCE flaw to backdoor Nextcloud serversBleepingComputer15.10.2026