Description
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
Published: 2026-10-14
Score: 9.2 Critical
EPSS: 73.3% High
KEV: Yes
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Collabora Online Built‑in CODE Server before 26.4.303 contains an OS command‑injection flaw in the proxy.php script that is triggered when the CODE server is not running, such as after a recent restart. The injection allows an attacker to execute arbitrary system commands on the host machine, potentially compromising confidentiality, integrity, and availability of the underlying server.

Affected Systems

The vulnerability affects only the Collabora Online Built‑in CODE Server deployed as a Nextcloud app in versions prior to 26.4.303. Stand‑alone Collabora Online servers are not impacted.

Risk and Exploitability

The CVSS v3.1 score is 9.2, indicating high severity. The EPSS score is 73 %, indicating a high probability of exploitation; the vulnerability is currently listed in CISA KEV. Based on the description, the likely attack vector is a remote HTTP request to proxy.php by an external user when the CODE server is offline. Attackers who can reach the Nextcloud application can send crafted requests to exploit the command injection and gain arbitrary code execution.

Generated by OpenCVE AI on October 29, 2026 at 22:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Collabora Online Built‑in CODE Server to version 26.4.303 or later
  • If an upgrade cannot be performed immediately, disable the Nextcloud app that provides the CODE Server feature until a patched version is available
  • Monitor web server logs for anomalous proxy.php requests and block suspicious traffic during the remediation window

Generated by OpenCVE AI on October 29, 2026 at 22:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:collabora:online:*:*:*:*:*:nextcloud:*:* cpe:2.3:a:collabora:collabora_online_-_built-in_code_server:*:*:*:*:*:nextcloud:*:*
Vendors & Products Collabora online

Thu, 29 Oct 2026 23:15:00 +0000

Type Values Removed Values Added
Title Remote OS Command Injection via proxy.php in Collabora Online Built‑in CODE Server

Mon, 26 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Collabora online
CPEs cpe:2.3:a:collabora:online:*:*:*:*:*:nextcloud:*:*
Vendors & Products Collabora online
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Sun, 25 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Collabora Online Built‑in CODE Server Enabling Remote Code Execution

Sat, 24 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Collabora Online Built‑in CODE Server Enabling Remote Code Execution

Fri, 23 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Collabora Online Built‑in CODE Server

Fri, 23 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2026-10-23T00:00:00+00:00', 'dueDate': '2026-10-26T00:00:00+00:00'}

Fri, 23 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Collabora
Collabora collabora Online - Built-in Code Server
Vendors & Products Collabora
Collabora collabora Online - Built-in Code Server

Fri, 16 Oct 2026 02:15:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Collabora Online Built‑in CODE Server

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Collabora Online Built‑in CODE Server Proxy

Wed, 14 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Collabora Online Built‑in CODE Server Proxy

Wed, 14 Oct 2026 02:45:00 +0000

Type Values Removed Values Added
Description Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
Weaknesses CWE-78
References
Metrics cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Collabora Collabora Online - Built-in Code Server
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-24T03:55:50.462Z

Reserved: 2026-10-14T02:27:41.637Z

Link: CVE-2026-110447

cve-icon Vulnrichment

Updated: 2026-10-14T19:04:37.530Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-14T03:17:20.683

Modified: 2026-10-30T16:32:46.647

Link: CVE-2026-110447

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T23:00:06Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')