CVE-2026-110447: Collabora Online Built-in CODE Server OS Command Injection

Overview

CVE-2026-110447 is a critical OS command injection vulnerability affecting the Collabora Online Built-in CODE Server, specifically when deployed as a Nextcloud app. This flaw enables remote code execution, allowing attackers to execute arbitrary commands on the underlying system. It is currently being exploited in the wild, making immediate patching crucial for affected Nextcloud instances.

Technical Analysis

The vulnerability, CWE-78 (Improper Neutralization of Special Elements used in an OS Command), resides in the proxy.php component of the Collabora Online Built-in CODE Server (richdocumentscode) Nextcloud app.
* It affects versions prior to 26.4.303.
* Exploitation occurs when the CODE server is not actively running, such as immediately after a system restart or if the service has crashed.
* Attackers can inject arbitrary OS commands, leading to remote code execution (RCE) on the host system.
* This vulnerability specifically impacts Nextcloud deployments utilizing the Built-in CODE Server and does not affect standalone Collabora Online servers.
* Active exploitation has been observed in the wild, with XMRIG malware linked to post-exploitation activities.

Detection

• Monitor web server access logs for requests to /index.php/apps/richdocumentscode/proxy.php containing suspicious command injection patterns (e.g., |, &, ;, $(...), ` followed by OS commands).
• Look for unusual process spawns originating from the web server process (e.g., apache, nginx, php-fpm) that execute shell commands (sh, bash, cmd.exe, powershell.exe) or known malware binaries like XMRIG.
• Monitor for unexpected outbound network connections from the web server to known C2 infrastructure or cryptocurrency mining pools.
• Review system logs for errors related to the CODE server not running, which could indicate a vulnerable state.

Sigma Detection Rules

Collabora Online CODE Server RCE Process Spawn

title: Collabora Online CODE Server RCE Process Spawn
id: c8f1e2d3-b4a5-6c7d-8e9f-0a1b2c3d4e5f
status: experimental
description: Detects suspicious process creation by web server processes, indicative of successful OS command injection in Collabora Online Built-in CODE Server (CVE-2026-110447).
logsource:
  product: linux
  service: auditd
detection:
  selection:
    ParentImage|endswith:
      - '/usr/sbin/apache2'
      - '/usr/sbin/httpd'
      - '/usr/bin/php-fpm'
      - '/usr/bin/nginx'
    Image|endswith:
      - '/bin/sh'
      - '/bin/bash'
      - '/usr/bin/wget'
      - '/usr/bin/curl'
      - '/usr/bin/python'
      - '/usr/bin/perl'
      - '/usr/local/bin/xmrig'
  condition: selection
level: critical

Collabora Online CODE Server Command Injection Attempt

title: Collabora Online CODE Server Command Injection Attempt
id: f0e1d2c3-a4b5-6d7e-8f9a-0b1c2d3e4f50
status: experimental
description: Detects patterns in web access logs indicative of OS command injection attempts against Collabora Online Built-in CODE Server (CVE-2026-110447).
logsource:
  category: webserver
  service: ['apache', 'nginx']
detection:
  selection:
    c-uri|contains:
      - '/index.php/apps/richdocumentscode/proxy.php'
      - '|'
      - '&'
      - ';'
      - '$('
      - '`'
      - 'cat /etc/passwd'
      - 'id'
      - 'whoami'
      - 'wget'
      - 'curl'
      - 'nc -e'
      - 'bash -i'
      - 'php -r'
  condition: selection
level: high

Mitigations

1. Immediately update the Collabora Online Built-in CODE Server (richdocumentscode) Nextcloud app to version 26.4.303 or later.
2. Ensure the CODE server service is configured for automatic restart and is actively running to reduce the window of vulnerability.
3. Implement strict egress filtering to prevent unauthorized outbound connections from web servers, especially to cryptocurrency mining pools or unknown IP addresses.
4. Apply the principle of least privilege to the web server user and associated processes to limit the impact of successful exploitation.
5. Regularly back up critical data and test restoration procedures.

References

• https://github.com/CollaboraOnline/richdocumentscode/issues/354
• https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110447

Indicators of Compromise

MITRE ATT&CK

• T1190 — Exploit Public-Facing Application
• T1059.004 — Unix Shell
• T1496 — Resource Hijacking