CVE-2026-110447
Nextcloud richdocumentscode proxy.php OS command injection
MITRE scores CVE-2026-110447 CVSS 4.0 9.2 in Collabora Online Built-in CODE Server (richdocumentscode) before 26.4.303. OS command injection in proxy.php when the CODE server is not running can yield unauthenticated RCE. The CVE states exploitation in the wild in September and October 2026. Fixed in 26.4.303. Not in CISA KEV.
- CVSS
- 9.2
- Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Class
- RCE
- Status
- Active Exploitation
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- Collabora
- Products
- Collabora Online - Built-in CODE Server, richdocumentscode, Nextcloud
- Affected
- richdocumentscode before 26.4.303 on Nextcloud with the Built-in CODE Server app. Reachable when the CODE server is not running (for example after a restart). Standalone Collabora Online, Docker or distro Collabora packages, and installs that do not use richdocumentscode are out of scope per public guidance.
- Fixed
- richdocumentscode 26.4.303, published 11 September 2026.
- CWE
- CWE-78
- Published
- 14 Oct 2026
- Updated
- 14 Oct 2026
The status above is the claim. Links do not upgrade it.
CVE-2026-110447 is an OS command injection (CWE-78) in the Nextcloud app Collabora Online - Built-in CODE Server (richdocumentscode) before 26.4.303. The MITRE CVE description says remote code execution is possible via proxy.php when the CODE server is not running (for example after a recent restart). Standalone Collabora Online servers are not affected; only this built-in CODE deployment path is in scope. The CVE states it is a different vulnerability than CVE-2025-66208.
MITRE publishes CVSS 4.0 9.2 (Critical) with privileges required none. NVD currently shows that Secondary MITRE metric and status Received. No separate GitHub Security Advisory (GHSA) under nextcloud/security-advisories was found for this CVE ID at research time. No credited researcher appears in the CVE credits field.
GitHub tag 26.4.303 was published 11 September 2026. Operator reports on CollaboraOnline/richdocumentscode issue 354 describe unauthenticated probes against /apps/richdocumentscode/proxy.php?status in September 2026 that dropped PHP webshells under the app directory. A Collabora maintainer told operators to upgrade to 26.4.303 and remove lingering shx*.php files. A Nextcloud community forum post on 3 October 2026 likewise urged built-in CODE users to update because of active webshell findings.
The CVE is not in the CISA KEV catalog (catalog 2026.10.13). ThreatWire found no dedicated articles from BleepingComputer, The Record, SecurityWeek, or The Hacker News on this CVE. No public proof-of-concept repository that credibly claims CVE-2026-110447 was found for a pocUrl field.