Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
Collabora — Collabora Online – Built-in CODE Server
- Added to KEV catalog
- 23 October 2026
- Federal remediation due date
- 26 October 2026
- Weakness classification (CWE)
- CWE-78
AI Breakdown
What it is
A security vulnerability in the Collabora Online Built-in CODE Server app for Nextcloud allows remote attackers to execute arbitrary operating system commands. This flaw exists within the proxy.php component and triggers when the CODE server is not actively running, such as right after a restart. The issue specifically impacts environments using the integrated CODE server app rather than standalone Collabora Online installations.
Why it matters
This vulnerability is being actively exploited in the wild, enabling attackers to gain unauthorized remote control over affected Nextcloud environments. Although confirmed ransomware associations are currently unknown, arbitrary code execution represents a critical risk to data and infrastructure integrity. Its addition to CISA's Known Exploited Vulnerabilities catalog underscores the need for immediate remediation.
Recommended action
Upgrade the Collabora Online Built-in CODE Server app to version 26.4.303 or later in accordance with vendor guidance. Evaluate all internet-exposed assets and ensure compliance with required CISA triage and risk-prioritization directives. If vendor updates cannot be applied immediately, isolate the application or discontinue use of the built-in server component.
AI-generated from CISA and NVD data — treat as a starting point, not a substitute for your own risk assessment.
CISA Description
Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516 ; https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-110447
NVD Technical Description
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services