CISAAnalysisCISA adds Collabora Online CODE server command injection flaw to KEV catalog
What happened.CISA added an actively exploited remote code execution vulnerability affecting the Collabora Online Built-in CODE Server app for Nextcloud to its Known Exploited Vulnerabilities catalog.
Why it matters.Self-hosted Nextcloud instances store corporate documents, user identities, and team communications. Active exploitation of the built-in office editor allows external attackers to deploy persistent PHP web shells and compromise private document repositories. Infrastructure operators must upgrade or uninstall vulnerable packages and inspect access logs for unexpected PHP scripts.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-110447 with a 9.2 CVSS score, the defect in the proxy script improperly handles request paths during server initialization.
- Exploitation path: Unauthenticated remote attackers submit crafted web requests when the document server restarts to execute arbitrary shell commands as the web server user.
- Remediation releases: Maintainers issued patches in richdocumentscode package version 26.4.303, with CISA establishing a binding remediation deadline of November 13, 2026.