CVE-2026-110447: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Rescana reports that, according to Collabora's advisory, a request to the app's proxy.php script can make the server run an operating system command as the web server user.[2] Rescana adds that the attack only works while the app's local CODE server is not running, for example during a container restart, an upgrade or after a crash.[2]Censys says the flaw is rated critical (CVSS v4.0 9.2)[3]. Censys also says it currently detects 19,454 hosts and 103,350 web properties with the app installed.[3]Rescana reports that Collabora said the app must be upgraded to 26.4.303 or later, or removed, because "It is not sufficient to disable the app to avoid the problem"[2]. eSecurity Planet reports that Collabora said standalone Collabora Online servers are not affected.[4]Aviatrix says multiple administrators reported compromised servers starting September 10, with attackers deploying PHP web shells and searching for cryptocurrency wallets, credential stores, and sensitive files.[5] Aviatrix adds that Collabora patched the vulnerability in version 26.4.303 on September 11, but the security advisory wasn't published until October 14[5].BleepingComputer reports that Collabora attributed the delayed announcement primarily to GitHub CVE-processing backlogs[1].According to Shattered.io, CISA added it on October 23, 2026. The federal remediation deadline is October 26, 2026.[6] eSecurity Planet warns that "Patching closes the vulnerability but does not remove existing attacker access."[4]