External risk intelligence

Nextcloud Collabora CODE Server OS Command Injection

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-110447

The vulnerable component is a Nextcloud application that provides web-based office document collaboration services. Such applications are typically deployed as internet-facing web services to allow remote access for users, making the web server and its associated PHP endpoints commonly reachable from the public internet.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in a specific integration of Collabora Online's CODE Server, affecting how it handles requests when the server is not running, such as after a restart. This issue could allow for remote code execution on affected systems. While this does not impact standalone Collabora Online servers, organizations using this specific Nextcloud app integration should assess their exposure.

Remote code execution risk exists.
Exploited in the wild; confirm relevance.
Assess exposure for specific Nextcloud integrations.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a crafted request to a vulnerable Nextcloud deployment. This is possible when the Collabora Online Built-in CODE Server is not running, such as after a recent restart, making the `proxy.php` file accessible for command injection. The attack does not require any special access or authentication, and the vulnerability can lead to remote code execution on the server.

No authentication or special access needed.
Triggered via `proxy.php` when CODE server is down.
Risk of remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When the Collabora Online CODE Server is not running, a critical OS command injection vulnerability in the richdocumentscode Nextcloud app could allow an unauthenticated attacker to execute arbitrary commands on the underlying operating system. This could impact the integrity and availability of the server and any data processed by the application.

Server operating system commands.
Exploited when CODE server is down.
Potential system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The vulnerability resides within the Collabora Online Built-in CODE Server, a Nextcloud app, impacting its `richdocumentscode` component. This issue necessitates action from teams responsible for managing Nextcloud instances and integrated applications. The initial step involves identifying all deployments of this specific CODE Server integration, assessing its reachability and criticality to business operations, and locating the accountable owner before planning remediation.

Nextcloud and application owners should investigate.
Verify CODE Server integration and reachability.
Plan remediation based on exposure and business impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Collabora Online Built-in CODE Server?

It is an application for Nextcloud that enables web-based document editing and collaboration. Often called richdocumentscode, this specific integration embeds the office server functionality directly within the Nextcloud environment, allowing users to create and edit documents without setting up a separate, standalone Collabora Online infrastructure.

What is the vulnerability in CVE-2026-110447?

This vulnerability is an OS command injection, classified as CWE-78. It means the application fails to properly sanitize input before passing it to the underlying operating system. In this case, it allows an attacker to send unauthorized commands to the host server, which the system then executes as if they were legitimate instructions from the software.

How is this OS command injection triggered?

The flaw exists in the proxy.php file and is specifically triggered when the CODE server component is not currently running, such as immediately after a system restart. If the server is actively running, the specific code path containing the vulnerability is not engaged. It does not require authentication or user interaction to trigger.

Is my instance affected by this vulnerability?

Halo Surface Signal indicates that because this app provides web-based collaboration, it is often deployed in internet-facing configurations to support remote work. If your Nextcloud instance uses the built-in CODE server integration, it is likely reachable from the public internet and potentially at risk. Standalone Collabora Online servers are not affected by this specific issue.

How should I respond to this threat?

First, identify if your Nextcloud environment uses the built-in CODE server app rather than a standalone setup. If you use the integrated version, evaluate the reachability of your server. Coordinate with your application owners to prioritize updates, as this ensures the component is patched to a version beyond the vulnerable threshold.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.