In the ever-evolving landscape of cybersecurity threats, a critical vulnerability has emerged affecting the Collabora Online Built-in CODE Server, a popular application used with Nextcloud. This flaw, tracked as CVE-2026-110447, poses a severe risk to affected systems, allowing attackers to take control and potentially access sensitive information.<\/p>\n
This vulnerability is particularly concerning because it has already been actively exploited in the wild during September and October 2026. This means attackers have been using this weakness to compromise systems before a fix was widely available.<\/p>\n
The core of the problem lies within the Once exploited, attackers can upload web shells, which are small scripts that grant them persistent remote access to the server. Reports indicate that these attackers then tried to find sensitive files, including cryptocurrency wallets and credential databases. The potential for data theft and complete system compromise is very high.<\/p>\n The vulnerability impacts Collabora Online Built-in CODE Server versions prior to 26.4.303. If you are running any version older than 26.4.303, your system is at risk. It\u2019s crucial to understand that even if the Collabora Online app is disabled in Nextcloud, older, vulnerable versions can still be exploited.<\/p>\n This vulnerability has been “Analyzed” and, more importantly, it has been “Exploited in the Wild.” This means real-world attacks have occurred, making immediate action absolutely necessary for all users of the affected software.<\/p>\n With a CVSS score of 9.8 out of 10, this vulnerability is rated as CRITICAL<\/strong>. This highest severity rating indicates that exploiting this flaw is straightforward and can lead to a complete compromise of confidentiality, integrity, and availability of the affected system without requiring complex attack methods or extensive user interaction.<\/p>\n Collabora has released updates to address this critical flaw.<\/p>\n In the ever-evolving landscape of cybersecurity threats, a critical vulnerability has emerged affecting the Collabora Online Built-in CODE Server, a popular application used with Nextcloud. This flaw, tracked<\/p>\n","protected":false},"author":17,"featured_media":2652,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1372,770,1208,757,695],"class_list":["post-4430","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-collabora-online","tag-nextcloud","tag-os-command-injection","tag-remote-code-execution","tag-web-security"],"yoast_head":"\nproxy.php<\/code> component of the Collabora Online Built-in CODE Server. When the CODE server, which handles document processing, isn’t running\u2014for instance, right after a system restart\u2014a specific type of attack called “OS command injection” becomes possible. This allows malicious actors to insert and execute their own commands on the underlying operating system. This vulnerability does not affect standalone Collabora Online servers; it\u2019s specific to deployments using the Built-in CODE Server as a Nextcloud app.<\/p>\nCVE Details<\/h2>\n
\n
Affected Products<\/h2>\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
\n
shx*.php<\/code> files or other suspicious files that may have been left behind by attackers. These files could still grant unauthorized access even after updating the primary vulnerability.<\/li>\ncoolwsd<\/code> process when the app is disabled, further hardening your system.<\/li>\n<\/ol>\nReferences<\/h2>\n
\n