CVE-2026-110447: Critical Collabora Command Injection

Are You Affected?

CVE-2026-110447 affects the Collabora Online Built-in CODE Server distributed as the Nextcloud richdocumentscode app. The vulnerable component is the integrated deployment used by Nextcloud, not necessarily standalone Collabora installations.

Start by checking whether Nextcloud instances use the Collabora Online - Built-in CODE Server app.

The affected range is richdocumentscode versions before 26.4.303. Nextcloud can update this app independently from a standalone Collabora deployment, so administrators should check the installed app version directly rather than infer status from the Nextcloud core version or a general Collabora version.

The NVD description states that standalone Collabora Online servers are not affected. Supplied research also identifies Docker-based Collabora deployments, RPM/DEB package deployments, and Nextcloud All-in-One images as outside the stated affected scope according to Collabora’s public guidance. Confirm those distinctions against your architecture and current vendor documentation before closing the investigation.

Analyst’s take: The first triage question is architectural. Determine whether the vulnerable richdocumentscode app is installed instead of searching for “Collabora” broadly. Because exploitation is confirmed, prioritize internet-reachable instances even if the CODE Server was recently restarted or is currently unavailable.

For related defensive guidance, see the edge security hardening checklist and learn how to document affected assets with network forensics.

The Fix, If You’re in a Hurry

Upgrade the Nextcloud built-in CODE Server app to version 26.4.303 or later. Prioritize internet-reachable Nextcloud systems, systems that recently restarted, and instances where the vulnerable app was exposed while the CODE Server was unavailable.

For a standard Nextcloud installation using occ, inspect the app first and then update it through the supported Nextcloud app-management process:

sudo -u www-data php occ app:list | grep -i richdocumentscode
sudo -u www-data php occ app:update richdocumentscode
sudo -u www-data php occ app:list | grep -A3 -B2 -i richdocumentscode

The update must result in version 26.4.303 or later. If the update command does not provide the required version, use the Nextcloud administration interface or a vendor-supported app package. Verify the installed version afterward. A successful command exit status does not prove that the fixed version is installed.

If you cannot patch immediately, disable or remove the built-in CODE Server app and isolate the affected Nextcloud service:

sudo -u www-data php occ app:disable richdocumentscode

This workaround can disrupt document editing and should be evaluated against business requirements. Network filtering may reduce exposure, but it is not a sufficient permanent mitigation because exploitation is confirmed.

If the service is disabled after possible compromise, preserve relevant evidence before making changes where feasible. Investigate the host for command execution, persistence, credential access, and outbound connections.

How This Vulnerability Works

CVE-2026-110447 is an OS command-injection vulnerability in the built-in CODE Server’s proxy.php functionality. The vulnerable condition occurs when the CODE Server is not running, including after a recent restart. Externally influenced input can reach command-construction logic without adequate neutralization, allowing an attacker to cause operating-system commands to execute remotely.

The impact is remote code execution under the privileges available to the affected service process. The precise command, execution context, and post-exploitation behavior depend on the Nextcloud and web-server configuration, filesystem permissions, isolation controls, and host operating system.

A low-privilege service account does not make the issue safe. Attackers may still access application data, credentials, tokens, configuration files, or pivot paths.

The flaw is specifically associated with the Nextcloud-integrated built-in CODE Server architecture. It is not described as affecting standalone Collabora Online servers. This distinction matters during asset triage: broad searches for “Collabora” may produce false positives, while searches limited only to the Nextcloud core package may miss the separately installed richdocumentscode app.

Technical Notes

The vulnerable request path is associated with proxy.php, particularly when the integrated CODE Server is unavailable. The available research does not provide a complete canonical exploit request or a vendor-published request signature. Avoid assuming that a single URL pattern will reliably identify exploitation.

For investigation, correlate web requests to proxy.php with process creation and service-availability events. A practical starting point is to search web-server and application logs for requests containing the affected path:

grep -RInE 'proxy\.php|richdocumentscode' \
  /var/log/nginx /var/log/apache2 /var/www/nextcloud/data 2>/dev/null

This is an investigation filter, not a definitive exploit signature. Normal application traffic may also reference the path. The stronger signal is a suspicious request followed closely by a web server or PHP worker spawning an unexpected shell, interpreter, downloader, or network utility.

Severity, Explained

The NVD base score is 9.8 out of 10.0, rated Critical. Available exploit characteristics indicate a network-reachable vulnerability with high impact and no meaningful requirement for an attacker to be present on the local host. The complete CVSS vector was not included in the supplied record, so defenders should copy the authoritative vector from the NVD or CVE record before using individual metrics in automated scoring or compliance reports.

The score is consistent with the operational risk. Exploitation can lead to remote code execution on a collaboration platform that may contain sensitive documents, user information, authentication material, and integrations with internal systems.

Internet exposure, service-account permissions, weak host isolation, and access to outbound networks can substantially increase the practical impact beyond the nominal base score.

The vulnerability is classified as CWE-78, Improper Neutralization of Special Elements used in an OS Command. CVSS describes severity characteristics; it does not account for every environmental factor. Asset exposure, data sensitivity, compensating controls, exploit evidence, and persistence should be incorporated into the organization’s priority decision.

Is It Being Exploited?

Yes. CVE-2026-110447 is confirmed exploited in the wild. The NVD description states that exploitation occurred during September and October 2026, and CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog on October 23, 2026, with a listed due date of October 26, 2026.

KEV inclusion is an operationally important confirmation that exploitation is not merely theoretical. The catalog’s ransomware field is listed as unknown. That does not reduce the urgency; it means CISA has not attributed this vulnerability to known ransomware campaigns in the catalog entry.

A public proof of concept or checker may exist. Supplemental search intelligence reports a Nuclei-based checker and labels exploitation as active, but that material was not directly verified as a primary vendor or project release in the supplied research. Treat public PoC availability as reported but not independently confirmed here.

The project-hosted richdocumentscode issue should be reviewed for linked commits, technical indicators, and reproduction information.

Because exploitation is confirmed, organizations should assume that an exposed vulnerable instance may have been tested or compromised, particularly if it was reachable from the internet or recently restarted while vulnerable.