Collabora Built-in CODE Server < 26.4.303 - OS Command Injection

Collabora Online Built-in CODE Server before 26.4.303 contains a command injection caused by improper handling in proxy.php when the CODE server is not running, letting remote attackers execute OS commands, exploit requires CODE server to be stopped. id: CVE-2026-110447 info: name: Collabora...

Collabora Online Built-in CODE Server Before 26.4.303 OS Command Injection

Collabora Online Built-in CODE Server versions before 26.4.303 contain an unauthenticated OS command injection vulnerability in proxy.php that can result in remote code execution when the CODE server is not running...

Exploit for OS Command Injection in Collabora Online

CVE-2026-110447 - Nextcloud richdocumentscode RCE 1-day Una...

Collabora Online built-in CODE server command injection

Added: 10/27/2026 Background Collabora Online is an online document editing suite. Collabora Online Development Edition CODE is the development version of Collabora Online. Problem The Collabora Online built-in CODE server contains a command injection vulnerability in proxy.php which is exploitab...

Collabora Online proxy.php Code Execution

The vulnerability in the proxy.php component of the Collabora Online online office suite is related to improper handling of special elements. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator VCO to its Known Exploited Vulnerabilities KEV, citing reports of active exploitation in the wild. The...

Nextcloud Collabora Online Built-in CODE Server 26.4.302 Command Injection Exposure Checker

The Collabora Online Built-in CODE Server richdocumentscode app for Nextcloud before version 26.4.303 contains an unauthenticated OS command injection vulnerability in proxy.php. This tool passively checks a supplied Nextcloud instance for public exposure indicators...

Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App

Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an...

CVE-2026-110447

Collabora Online Built-in CODE Server before 26.4.303 richdocumentscode, a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't...

CVE-2026-110447

Collabora Online Built-in CODE Server before 26.4.303 richdocumentscode, a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't...

CVE-2026-110447

Collabora Online Built-in CODE Server before 26.4.303 richdocumentscode, a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't...

EUVD-2026-100780

Collabora Online Built-in CODE Server before 26.4.303 richdocumentscode, a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't...

CVE-2026-110447

Collabora Online Built-in CODE Server before 26.4.303 richdocumentscode, a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't...

CVE-2026-110447

Collabora Online Built-in CODE Server before 26.4.303 richdocumentscode, a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't...

CVE-2026-110447

The Collabora Online Built-in CODE Server (Nextcloud app richdocumentscode ) is vulnerable to remote code execution (RCE) via an OS command injection in the proxy.php script. The flaw occurs specifically when the CODE server is not running, such as immediately after a restart, crash, or upgrade. ...

CVE-2026-110447: Improper Neutralization of Special Elements used in an OS Command

Collabora Online Built-in CODE Server before 26.4.303 richdocumentscode, a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't...

VulnCheck KEV: CVE-2026-110447

Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running...

Collabora Online richdocumentscode command injection vulnerability

Collabora Online versions prior to 26.4.303 contain a command injection vulnerability. This vulnerability stems from OS command injection in proxy.php; when the CODE server is not running, it may lead to remote code execution...

PT-2026-113607

Name of the Vulnerable Software and Affected Versions Collabora Online Built-in CODE Server richdocumentscode versions prior to 26.4.303 Description An OS command injection flaw exists in the proxy.php file of the Collabora Online Built-in CODE Server for Nextcloud. This issue allows...

PT-2026-93946

A Server-Side Request Forgery vulnerability exists in sat proxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curl setoptCURLOPT URL without host or scheme validation. An unauthenticated remote attacker can leverage this to...