Remote code execution affecting Collabora Online Built-in CODE Server
A vulnerability affecting Collabora Online Built-in CODE Server (Nextcloud richdocumentscode application) would allow an unauthenticated attacker to remotely execute arbitrary code on affected systems.
Description
Technical context and vulnerability details
Collabora Online Built-in CODE Server is a component integrated into the Nextcloud application, allowing collaborative editing of documents. This product is affected by a vulnerability labeled CVE-2026-110447 which results from an injection of system commands in the proxy.php script relaying HTTP requests between Nextcloud and the local CODE server. Exploitation of this vulnerability would allow an unauthenticated attacker to execute arbitrary commands on the system with web server privileges. Operation is only possible when the CODE server is not running, in particular after a restart. It is classified critical with a severity score of 9.2 according to CVSS V4.0.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Compromise of system integrity;
- Data privacy breach;
- Data integrity breach;
Affected systems
Products, components and targeted versions
- Collabora Online Built-in CODE Server (Nextcloud richdocumentscode app) versions earlier than 26.4.303;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update Collabora Online Built-in CODE Server (Nextcloud richdocumentscode app) to version 26.4.303 or later;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.