CVE-2026-110447
9.2CriticalPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-78
Impact
Unauthenticated attackers can execute arbitrary OS commands remotely when the built-in CODE server is stopped or restarting. Exploitation requires only network access to the Nextcloud instance.
Root cause
Improper input sanitization leads to OS command injection in proxy.php while the CODE server process is down.
Affected systems
Collabora Online Built-in CODE Server (richdocumentscode Nextcloud app) prior to 26.4.303; standalone Collabora Online servers are unaffected.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade the Nextcloud richdocumentscode app to version 26.4.303 or later. If patching immediately is not possible, disable the richdocumentscode app until it can be updated.
$ sudo -u www-data php /var/www/nextcloud/occ app:update richdocumentscodeAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.