Critical OS Command Injection in Collabora Online Built‑in CODE Server (CVE‑2026‑110447) Enables Unauthenticated Code Execution
What It Is – A critical OS command‑injection flaw (CVSS 9.2) in the proxy.php component of Collabora Online – Built‑in CODE Server (Nextcloud app) allows unauthenticated attackers to run arbitrary shell commands when the built‑in CODE server is stopped.
Exploitability – Exploits have been observed in the wild since September 2026, with attackers deploying PHP web shells and harvesting configuration files. No public exploit code is required beyond crafted HTTP requests.
Affected Products – Collabora Online – Built‑in CODE Server (Development Edition) versions ≤ 26.4.302. Stand‑alone Collabora servers are not impacted.
Why It Matters for Trust & Control Assurance
- Vulnerability Management – The flaw underscores the need for continuous patch‑management evidence; a single unpatched component can break a chain of trust.
- Secure Configuration & Logging – Proper sanitization and audit logging of request handling are control objectives that, when demonstrated, satisfy multiple framework requirements (e.g., NIST CSF 2.0 Identify and Protect).
- Defensible Audit Trail – Demonstrating that the vulnerable version was identified, patched, and that residual files (e.g.,
shx*.php) were removed provides concrete evidence for auditors and enterprise buyers.
Recommended Actions
- Upgrade immediately to Collabora Online Built‑in CODE Server 26.4.303 or later.
- Remove any leftover
shx*.phpfiles from the deployment directory. - Verify that the built‑in CODE server is running before applying the patch; schedule updates during maintenance windows to avoid the “stopped” state.
- Enrich your vulnerability‑management process with automated detection of
proxy.phprequest anomalies and retain logs for at least 90 days. - Map this CVE to your control framework and capture remediation evidence in a centralized Trust Center.
Source: Security Affairs – CISA adds Collabora Online flaw to KEV catalog