Collabora CODE Server CVE-2026-110447

Exploitable only against Nextcloud instances running the Collabora 'Built-in CODE Server' app (richdocumentscode) before 26.4.303; standalone Collabora Online servers are explicitly NOT affected. The specific prerequisite is that the bundled CODE server process is not currently running - e.g., in the window right after the product/server is restarted or when CODE has crashed - during which proxy.php processes attacker input unsafely (reflected by AT:P in the CVSS 4.0 vector). No authentication and no user interaction are required (PR:N/UI:N), so the practical limiting factor is timing: the attacker must send the request while CODE is down, which narrows but does not eliminate the opportunity for an attacker who polls the endpoint.

This is a genuine high-priority issue, not a paper-tiger high-CVSS finding. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, VC:H/VI:H/VA:H, score 9.2) describes a network-reachable, unauthenticated OS command injection yielding full confidentiality, integrity, and availability impact on the affected host - the worst realistic outcome short of a scope change. The single moderating signal is AT:P (an attack requirement): exploitation is only possible during the window in which the CODE server is not running (e.g., just after a restart), so this behaves more like a timing/race condition than a constantly-available flaw, which is why I down-rate attack complexity in my own 3.1 assessment. Signals are mostly aligned toward urgency: the description explicitly claims exploitation in the wild during September and October 2026, and CWE-78 plus a reachable proxy.php endpoint make reliable code execution plausible. The notable gap is that no EPSS score, no CISA KEV field, and no POC flag were supplied in the structured input - so the 'exploited in the wild' claim comes only from the CVE description/MITRE text and is not independently corroborated by a KEV entry or exploitation-probability metric here. Treat as high priority for any Nextcloud deployment running the built-in CODE server, while verifying the exploitation claim against CISA KEV / vendor telemetry before assuming widespread automated attacks.

A remote, unauthenticated attacker repeatedly probes a Nextcloud server's richdocumentscode proxy.php endpoint, waiting for the moment the built-in CODE server is not running (for example immediately after a server restart or a CODE crash). During that window proxy.php passes attacker-controlled input into an OS command, letting the attacker execute arbitrary commands on the host as the web service account. Active exploitation is reported in the CVE description (Sept-Oct 2026); no public POC code is referenced in the provided data, though a GitHub issue is linked.