---
id: CVE-2026-110447
title: >-
  Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a
  Nextcloud app, allows remote code execution, as exploited in the wild in
  September and October 2026, a different vulnerability than CVE-2025-66208
summary: >-
  Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a
  Nextcloud app, allows remote code execution, as exploited in the wild in
  September and October 2026, a different vulnerability than CVE-2025-66208.
  This is an O…
severity: critical
cwe:
  - CWE-78
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T19:17:10.487'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110447'
references:
  - url: 'https://github.com/CollaboraOnline/richdocumentscode/issues/354'
    label: cve@mitre.org
  - url: 'https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516'
    label: cve@mitre.org
tags:
  - nvd
  - in-the-wild
  - cve.org
  - exploit-available
  - kev
epss: 0.11634
epssPercentile: 0.96027
exploited: true
ingestedAt: '2026-10-14T04:12:54.303Z'
vendor: Collabora
product: richdocumentscode
affected:
  - richdocumentscode < 26.4.303
cvss: 9.2
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
ssvc:
  exploitation: active
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-23T20:04:16.288937Z'
cvssSource: cna
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/adriyansyah-mf/cve-2026-110447'
  checkedAt: '2026-10-27T16:56:36.435Z'
exploitAvailable: true
kev: true
kevDateAdded: '2026-10-23'
kevDueDate: '2026-10-26'
kevRansomware: false
---

## Overview

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.