CVE-2026-110447

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110447
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110447.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110447
Published
2026-10-14T02:27:42Z
Modified
2026-10-15T10:30:24Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
[none]
Details

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.

Database specific 
{
    "cna_assigner":  "mitre",
    "cwe_ids":  [
        "CWE-78"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110447.json"
}
References

Affected packages

Git / github.com/collaboraonline/richdocumentscode

Affected ranges

Type
GIT
Repo
https://github.com/collaboraonline/richdocumentscode
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e0221971cc3e0cf39db4672bef54ad60bab90486
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "26.4.303"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

21.*
21.11.103
21.11.202
21.11.203
21.11.204
21.11.3
21.11.306
21.11.4
21.11.402
21.11.502
21.11.6
22.*
22.5.1002
22.5.1201
22.5.1301
22.5.301
22.5.401
22.5.502
22.5.702
22.5.802
23.*
23.5.1001
23.5.102
23.5.103
23.5.104
23.5.202
23.5.301
23.5.4
23.5.401
23.5.402
23.5.403
23.5.5
23.5.501
23.5.502
23.5.503
23.5.601
23.5.602
23.5.604
23.5.702
23.5.705
23.5.904
24.*
24.4.1002
24.4.102
24.4.103
24.4.1102
24.4.1203
24.4.1204
24.4.1302
24.4.1303
24.4.201
24.4.402
24.4.502
24.4.602
24.4.701
24.4.702
24.4.802
24.4.901
24.4.902
25.*
25.4.201
25.4.202
25.4.301
25.4.402
25.4.403
25.4.502
25.4.503
25.4.504
25.4.602
25.4.702
25.4.802
25.4.901
25.4.902
25.4.903
25.4.904
26.*
26.4.103
26.4.104
26.4.302
4.*
4.2.301
4.2.400
4.2.401
4.2.402
4.2.403
4.2.404
4.2.405
4.2.406
4.2.407
4.2.602
4.2.800
6.*
6.4.003
6.4.007
6.4.009
6.4.010
6.4.011
6.4.013
6.4.1002
6.4.1003
6.4.1004
6.4.1103
6.4.13
6.4.1303
6.4.14
6.4.202
6.4.203
6.4.301
6.4.302
6.4.303
6.4.403
6.4.503
6.4.601
6.4.606
6.4.607
6.4.608
6.4.702
6.4.703
6.4.704
6.4.705
6.4.806

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110447.json"