# CVE-2026-110447

> **Collabora Collabora Online – Built-in CODE Server** vulnerability · **listed in CISA Known Exploited Vulnerabilities catalog**.

## Description

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.

## Key facts

- **CVE ID:** CVE-2026-110447
- **Vendor:** Collabora
- **Product:** Collabora Online – Built-in CODE Server
- **Published:** 2026-10-14
- **CISA remediation due date:** 2026-10-26
- **CWE codes:** CWE-78

## Primary sources

- NIST NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110447
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

## Citation

> MORVS. CVE-2026-110447. Retrieved 2026-10-27 from https://api.morvs.ai/cve/CVE-2026-110447. Derived from NIST NVD + CISA KEV. Licensed CC0.

---

*[Dataset catalog](https://api.morvs.ai/datasets/) · [MORVS](https://morvs.ai/) · CC0 1.0*