Collabora Online – Built-in CODE Server Command Injection (CVE-2026-110447)

Nextcloud administrators leveraging integrated document editing should take immediate note of CVE-2026-110447, an OS command injection vulnerability in the Collabora Online – Built-in CODE Server. The flaw allows remote code execution under specific backend conditions, specifically when the built-in CODE server process is inactive or stopped. Because Nextcloud deployments are frequently exposed to the public internet to facilitate remote collaboration, unauthenticated or low-privileged network attackers can target this state-handling edge case to execute arbitrary system commands on the host.

Understanding CVE-2026-110447 Execution Mechanics

Classified under CWE-78, OS command injection flaws in web application wrappers typically emerge when application code attempts to invoke system binaries or manage sub-processes using unsanitized user inputs. In the context of the Nextcloud built-in CODE (Collabora Online Development Edition) server integration, the vulnerability triggers when the application attempts to interact with or spawn the backend document processing engine while the CODE service is not actively running.

When an HTTP request triggers a document handling operation, the underlying wrapper evaluates whether the local CODE daemon is responsive. If the service is stopped, the application attempts to invoke launch scripts or binaries via direct shell execution calls. Because input parameters passed into this execution path fail to neutralize shell metacharacters, a crafted request to the Nextcloud document endpoint allows an attacker to inject arbitrary commands. These commands execute with the security context of the web server process (typically www-data or apache).

Realistic Exposure and Threat Profile

Nextcloud and Collabora Online are widely deployed across enterprise, government, healthcare, and education environments that require self-hosted document collaboration. The built-in CODE server option is particularly popular in smaller or simplified deployments because it packages the document engine directly into the PHP application environment, avoiding the need for a separate Docker container or dedicated backend server.

With an EPSS score of 1.2% placing it in the 68.6th percentile for exploitation probability, this flaw warrants prompt attention despite not yet seeing widespread automated exploit chatter. Command injection vulnerabilities in internet-facing web applications are prime targets for initial access brokers and ransomware affiliates. A successful exploit granting access as the web server user allows adversaries to extract Nextcloud database credentials from config.php, access stored sensitive files, execute local privilege escalation exploits, or establish persistent web shells on the host platform.

Required Remediation Actions

Organizations using Collabora Online integrated with Nextcloud must enforce updates or temporary workarounds ahead of the October 26, 2026 remediation compliance deadline:

• Apply the Vendor Update: Update the built-in CODE server app (richdocumentscode) to the latest fixed release via the Nextcloud Administrative App Management console or via the command line using occ app:update richdocumentscode.
• Disable the Built-In App if Unpatched: If a patch cannot be applied immediately, disable the app using occ app:disable richdocumentscode to eliminate the exposed execution path.
• Migrate to Standalone CODE: For high-availability production environments, transition from the built-in PHP wrapper to a standalone, containerized Collabora Online (coolwsd) server deployed behind an isolated reverse proxy.
• Forensic Verification: Audit web server logs and host process trees for unexpected child processes spawned by www-data or apache, paying close attention to outbound network traffic originating from the web host.