---
title: 'Collabora Online built-in CODE Server flaw exploited in the wild; update to 26.4.303'
url: 'https://www.securteksecurity.com/news/collabora-code-server-flaw-cve-2026-110447-exploited'
markdown: 'https://www.securteksecurity.com/news/collabora-code-server-flaw-cve-2026-110447-exploited.md'
date: '2026-10-14'
description: 'CVE-2026-110447 is an OS command injection in proxy.php in the Collabora Online built-in CODE Server (the Nextcloud richdocumentscode app) before version 26.4.303. The CVE record states it was exploited in the wild in September and October 2026; webshells have been reported. Standalone Collabora On…'
taxonomy:
  category:
    - Cybersecurity
---

# [Collabora Online built-in CODE Server flaw exploited in the wild; update to 26.4.303](https://www.securteksecurity.com/news/collabora-code-server-flaw-cve-2026-110447-exploited)

   14th Oct 2026  

CVE-2026-110447 is an OS command injection in proxy.php in the Collabora Online built-in CODE Server (the Nextcloud richdocumentscode app) before version 26.4.303. The CVE record states it was exploited in the wild in September and October 2026; webshells have been reported. Standalone Collabora Online servers are not affected.

Sources: [CVE record](https://www.cve.org/CVERecord); [NVD](https://nvd.nist.gov/vuln/detail/cve-2026-110447)

---

## Navigation

- Parent: [News](https://www.securteksecurity.com/news.md)
- Previous: [Cisco Secure Email Gateway zero-day exploited in the wild (CVE-2026-76519)](https://www.securteksecurity.com/news/cisco-secure-email-gateway-zero-day-cve-2026-76519-actively-exploited.md)
- Next: [Czech NÚKIB warns Russian actors are phishing Signal users through linked devices](https://www.securteksecurity.com/news/czech-nukib-warns-signal-linked-device-phishing.md)