CVE-2026-110447

CVE-2026-110447 is an OS command injection vulnerability affecting the Collabora Online Built-in CODE Server (`richdocumentscode`) Nextcloud app in versions prior to 26.4.303. The flaw resides in the `proxy.php` file and is triggered when the CODE server is not running, such as immediately following a system restart. During this state, the wrapper launches the Collabora AppImage via a PHP execution call that fails to properly neutralize externally-influenced input. Attackers can exploit this by sending crafted HTTP GET requests containing encoded path traversal sequences (`%2e%2e`) to the status endpoint, allowing them to execute arbitrary commands on the host. Standalone Collabora Online servers are unaffected by this issue. This vulnerability has been actively exploited in the wild, with threat actors using it to deploy PHP webshells on exposed servers. Once access is established under the web server account, attackers have been observed executing discovery commands to search for password databases—such as Bitwarden, 1Password, and `.kdbx` files—as well as cryptocurrency wallets. To mitigate this risk, administrators are advised to update the Nextcloud app to version 26.4.303 or later and audit their systems for potential indicators of compromise.