CVE-2026-110447

Name of the Vulnerable Software and Affected Versions Collabora Online Built-in CODE Server (richdocumentscode) versions prior to 26.4.303

Description An OS command injection issue exists in the proxy.php endpoint of the richdocumentscode app. The flaw occurs when the built-in CODE server is not running, such as during restarts, upgrades, or after crashes. The script improperly handles request text, including the URL path, by inserting it into a double-quoted Bash command, allowing unauthenticated attackers to execute arbitrary operating-system commands using a $(...) sequence in the URL path. This issue has been exploited in the wild since September 10, 2026, with attackers deploying PHP webshells to perform reconnaissance on credential stores and cryptocurrency wallets. Standalone Collabora Online servers are not affected.

Recommendations Update richdocumentscode to version 26.4.303 or later. Remove the richdocumentscode app completely if it is not required. For Nextcloud 29 and earlier installations, upgrade Nextcloud to version 30 or later before updating the app. As a temporary mitigation, restrict access to the proxy.php endpoint.