Alex Joseph
In the ever-evolving landscape of cybersecurity threats, a critical vulnerability has emerged affecting the Collabora Online Built-in CODE Server, a popular application used with Nextcloud. This flaw, tracked as CVE-2026-110447, poses a severe risk to affected systems, allowing attackers to take control and potentially access sensitive information.
This vulnerability is particularly concerning because it has already been actively exploited in the wild during September and October 2026. This means attackers have been using this weakness to compromise systems before a fix was widely available.
The core of the problem lies within the proxy.php component of the Collabora Online Built-in CODE Server. When the CODE server, which handles document processing, isn’t running—for instance, right after a system restart—a specific type of attack called “OS command injection” becomes possible. This allows malicious actors to insert and execute their own commands on the underlying operating system. This vulnerability does not affect standalone Collabora Online servers; it’s specific to deployments using the Built-in CODE Server as a Nextcloud app.
Once exploited, attackers can upload web shells, which are small scripts that grant them persistent remote access to the server. Reports indicate that these attackers then tried to find sensitive files, including cryptocurrency wallets and credential databases. The potential for data theft and complete system compromise is very high.
CVE Details
- Product: Collabora Online Built-in CODE Server (Nextcloud app)
- Published Date: October 14, 2026
- Severity: Critical
- Status: Analyzed
Affected Products
The vulnerability impacts Collabora Online Built-in CODE Server versions prior to 26.4.303. If you are running any version older than 26.4.303, your system is at risk. It’s crucial to understand that even if the Collabora Online app is disabled in Nextcloud, older, vulnerable versions can still be exploited.
Current Status
This vulnerability has been “Analyzed” and, more importantly, it has been “Exploited in the Wild.” This means real-world attacks have occurred, making immediate action absolutely necessary for all users of the affected software.
Severity Level
With a CVSS score of 9.8 out of 10, this vulnerability is rated as CRITICAL. This highest severity rating indicates that exploiting this flaw is straightforward and can lead to a complete compromise of confidentiality, integrity, and availability of the affected system without requiring complex attack methods or extensive user interaction.
Possible Solutions
Collabora has released updates to address this critical flaw.
- Update Immediately: The most important step is to upgrade your Collabora Online Built-in CODE Server to version 26.4.303 or later. This version contains the necessary fixes to prevent the OS command injection.
- Check for Lingering Web Shells: If your system was running a vulnerable version, it is highly recommended to scan for and remove any
shx*.phpfiles or other suspicious files that may have been left behind by attackers. These files could still grant unauthorized access even after updating the primary vulnerability. - Ensure Disabled Apps are Updated: As noted by the vendor, simply disabling the app is not enough to protect against this vulnerability if the underlying software is not updated. Ensure all Nextcloud apps, even those not actively in use, are updated to their latest secure versions. Version 26.4.502 and later include a specific fix to properly stop the
coolwsdprocess when the app is disabled, further hardening your system.
References
- https://github.com/CollaboraOnline/richdocumentscode/issues/354
- https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110447
- https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh
