CVE-2026-110447: RCE in Collabora Online CODE Server

CVE-2026-110447 is an OS command injection in proxy.php affecting Collabora Online Built-in CODE Server (richdocumentscode), a Nextcloud app in versions before 26.4.303. The flaw enables remote code execution when the CODE server is not running, such as after system restart. Impact is confined to Nextcloud installations with integrated CODE Server; standalone Collabora Online servers are not vulnerable.

The official CVSS is 9.8 with critical rating. The vulnerability was actively exploited in the wild during September and October 2026. Public exploit repositories on GitHub were reported October 29, 2026, matching real-world exploitation timeline. This is a distinct vulnerability from CVE-2025-66208, another Collabora flaw. NIST published the advisory on October 14, 2026.

Immediate actions: upgrade Collabora Online CODE Server to version 26.4.303 or higher, review proxy.php logs for suspicious commands during CODE server downtime periods, monitor execution of elevated-privilege processes on affected Nextcloud systems. Since the trigger condition is CODE server inactivity, operational continuity and automatic service startup significantly reduce the exposure window.

Critical defensive aspects: the vulnerability does not affect standalone Collabora Online deployments (not integrated with Nextcloud). Nextcloud administrators must verify the richdocumentscode version currently in use via the admin panel. It is essential to ensure CODE server is configured for automatic startup after system reboots and implement continuous monitoring on service availability to rapidly identify unintended downtime windows.