Tag
#command-injection
Collabora CODE Server RCE Exploited in the Wild (CVE-2026-110447)
Collabora rates CVE-2026-110447 as Critical, CVSS v4.0 9.2: an unauthenticated attacker can run operating-system commands as the web server user through proxy.php of the Collabora Online Built-in CODE Server app (richdocumentscode) for Nextcloud, in versions before 26.4.303, whenever the built-in CODE server is not running. Fixed in app release 26.4.303. CISA added it to the KEV catalog on October 23, 2026, and administrators have reported attacks since mid-September 2026.
Oct 24, 2026