Key points
- The vulnerability allows remote code execution on affected systems.
- It is actively being exploited in the wild as of September 2026.
- A fix is available in version 26.4.303 of the richdocumentscode app.
Administrators using the Collabora Online Built-in CODE Server must update their installations immediately. The component, identified as richdocumentscode within Nextcloud, contains a critical security flaw. Versions prior to 26.4.303 are vulnerable to remote code execution. The National Vulnerability Database rates the issue as critical with a CVSS score of 9.2. Attackers have been exploiting this weakness in the wild during September and October 2026. This incident is distinct from CVE-2025-66208.
In plain English
The flaw exists in a file called proxy.php. It allows an attacker to run operating system commands on the server. This happens when the CODE server is not currently running. For example, if the product was recently restarted, the vulnerability is active. Attackers can send specific requests that trick the system into executing malicious code. This enables remote code execution on the host. The issue does not affect standalone Collabora Online servers. Only deployments using the built-in CODE Server are at risk.
The background
The vulnerability is classified as CWE-78, which refers to OS command injection. The flaw was assigned CVE-2026-110447 by security databases. Researchers noted active exploitation in late summer and early autumn of 2026. The attack vector requires the target system to be in a specific state. The CODE server must be down or restarting for the injection to succeed. This window of vulnerability allows remote attackers to execute code. The issue is specific to the integrated Nextcloud app.
What changes now
A patch has been released to address this critical issue. Version 26.4.303 of the richdocumentscode application contains the necessary fix. Organizations should verify their current version against this threshold. If the installed version is lower than 26.4.303, an update is required. The fix addresses the vulnerability in the built-in server. Users of standalone Collabora Online servers do not need to take action. They are not affected by this specific vulnerability in the built-in server component.
Who needs to act first
Teams should prioritize systems that are directly accessible from the internet. Check your inventory for any instances running the built-in CODE Server. Verify the current version of the richdocumentscode app on each host. Before applying updates, create a backup of your configuration and data. Test the upgrade in a staging environment first. Ensure the patch resolves the issue without breaking existing functionality. Roll out the fix to production systems in small batches. Monitor logs for any unusual activity during the transition.
What to do and how to stay safe: Collabora Online
- Identify all servers running Collabora Online Built-in CODE Server below version 26.4.303.
- Download and install the latest version of the richdocumentscode app immediately.
- Monitor server logs for signs of unauthorized command execution or suspicious restarts.
- Restrict network access to the service if immediate patching is not possible.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is my standalone Collabora Online server affected?
No, the vulnerability only affects the built-in CODE Server deployment within Nextcloud.
What version fixes the command injection flaw?
Version 26.4.303 of the richdocumentscode app contains the fix for CVE-2026-110447.
When was this vulnerability being exploited?
Active exploitation was observed in September and October 2026 according to the NVD.
