Collabora Online built-in CODE Server flaw exploited in the wild; update to 26.4.303

14th Oct 2026

CVE-2026-110447 is an OS command injection in proxy.php in the Collabora Online built-in CODE Server (the Nextcloud richdocumentscode app) before version 26.4.303. The CVE record states it was exploited in the wild in September and October 2026; webshells have been reported. Standalone Collabora Online servers are not affected.

Sources: CVE record; NVD