CVE-2026-110447 Collabora CVE debrief

Who should care

Nextcloud administrators and users with Collabora Online Built-in CODE Server, especially those with exposed instances, should assess their exposure and update to version 26.4.303 or later.

Why it matters

CVE-2026-110447 is a critical vulnerability in Collabora Online Built-in CODE Server, allowing remote code execution when exploited. Nextcloud administrators and users with exposed instances should assess their exposure and update to version 26.4.303 or later.

• Remote code execution is possible, allowing attackers to gain control of the server
• Exploitation in the wild indicates active targeting of vulnerable instances
• CODE Server not running (e.g., after a restart) increases the attack surface
• Verification of server status and update to patched version is crucial

Technical summary

The vulnerability is an OS command injection in proxy.php when the CODE server isn't running. It allows remote code execution and has been exploited in the wild. Only deployments with CODE Server are affected, not standalone Collabora Online servers. The issue arises from the product's handling of commands, allowing attackers to inject malicious OS commands. This can lead to arbitrary code execution, giving attackers control over the server. The vulnerability's presence in the wild indicates a high likelihood of active exploitation. Therefore, it is crucial to update to version 26.4.303 or later and implement additional security measures to mitigate potential attacks.

Defensive priority

High priority for Nextcloud users with Collabora Online Built-in CODE Server, especially those with exposed instances.

Recommended defensive actions

• Update Collabora Online Built-in CODE Server to version 26.4.303 or later
• Restrict access to CODE Server to trusted users only
• Monitor CODE Server logs for suspicious activity
• Consider using a Web Application Firewall (WAF) to detect and prevent attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, its exploitation in the wild, and affected versions. However, specific details about the number of affected instances or exploitation success are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.