CVE-2026-110447
OS command injection in Collabora CODE Server allows remote code execution on Nextcloud
An OS command injection flaw in the Collabora Online Built-in CODE Server app for Nextcloud lets attackers run operating system commands on the server. Attackers are actively exploiting this to plant PHP webshells and steal credentials from affected servers. A fix is available in version 26.4.303 of the app, and CISA has added the vulnerability to its Known Exploited Vulnerabilities list.
Collabora Collabora Online – Built-in CODE Server · Updated 28 Oct · From 1 of our story and the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 23 Oct; US agencies must fix by 26 Oct
SeveritycriticalCVSS 9.2 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| Collabora Online - Built-in CODE Server 26.4 | 26.4.303 |
What to do
- Update the Collabora Online Built-in CODE Server app to version 26.4.303 immediately to patch the command injection.
- Treat this as urgent because attackers are actively exploiting it in the wild and CISA requires US federal agencies to fix it by October 26, 2026.
- Check your Nextcloud servers for signs of compromise such as unknown files or webshells if you delayed applying the update.
What happened
- 15 OctZotpaper discloses that hackers are actively exploiting the command injection flaw in the Nextcloud Collabora app, noting it had been under attack for a month.
- 23 OctCISA adds the vulnerability to its Known Exploited Vulnerabilities catalog, ordering US federal agencies to patch by October 26.
- 24 OctThe Hacker News reports on CISA flagging the two critical flaws in Collabora Online and Arista VeloCloud.
- 26 OctDeadline for US federal agencies to apply the fix for the actively exploited vulnerability.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-110447 | Collabora Online – Built-in CODE Server OS Command Injection Vulnerability | critical 9.2 | 23 Oct | 12% |
Our reporting
15 OctHackers exploit unpatched Collabora flaw to backdoor Nextcloud serversReported elsewhere
The Hacker News · 24 OctCISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud ↗CISA · 23 OctCISA Adds One Known Exploited Vulnerability to Catalog ↗The records
help.nextcloud.com: advisory ↗CISA known-exploited catalog ↗CVE-2026-110447 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works