CVE-2026-110447

Executive Summary

CVE-2026-110447 is an OS command injection vulnerability in the Collabora Online Built-in CODE Server (richdocumentscode), a Nextcloud app, affecting versions before 26.4.303. The flaw resides in proxy.php and is triggered specifically when the embedded CODE server process is not running (for example, immediately following a restart), allowing an unauthenticated or low-privileged remote attacker to execute arbitrary operating system commands. The vulnerability has been observed exploited in the wild during September and October 2026; it is distinct from CVE-2025-66208, and standalone Collabora Online servers are not affected.

Technical Analysis

The affected component is the Nextcloud richdocumentscode app, which embeds a built-in CODE server. CODE (Collabora Online Development Edition) is the document rendering engine used by Collabora Online. In this specific deployment model, the Nextcloud app bundles the CODE server rather than connecting to an externally hosted Collabora Online instance.

The vulnerability is classified as OS command injection (CWE-78) and is located in proxy.php. According to the NVD description, exploitation requires a specific precondition: the CODE server must not be running. This is explicitly described as occurring "e.g., the product was recently restarted." This precondition is significant from an attack-surface perspective — it means the vulnerable code path in proxy.php is reached precisely when the app cannot delegate document handling to the backend CODE server.

In this state, proxy.php presumably acts as a fallback or forwarding mechanism. The fact that the CODE server's unavailability is the trigger strongly suggests that the vulnerable logic invokes an external process or shell command — for example, to attempt to start, health-check, or otherwise interact with the CODE server — and that this invocation occurs under conditions where attacker-influenced input can reach the command line without adequate sanitization. OS command injection of this class occurs when untrusted input is concatenated into a shell command string and passed to a command interpreter without escaping or argument separation.

However, the NVD description does not disclose the specific injection parameter, the exact shell command, or the vulnerable code lines within proxy.php. No function names, parameter names, or API paths beyond proxy.php are provided. Analysts should therefore treat the precise injection vector as undocumented; the confirmed facts are: (1) the affected file is proxy.php, (2) the flaw class is OS command injection, and (3) the trigger condition is the CODE server being in a non-running state. The vulnerability does not exist in standalone Collabora Online servers — only the Nextcloud deployment combining richdocumentscode is affected.

Because exploitation was recorded in the wild in September and October 2026, the vulnerability is operational and actively targeted, despite the absence of a public proof-of-concept or Nuclei template in tracked sources.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (OS command injection) and the explicitly stated preconditions in the NVD description. Specific parameter names and payload strings are not disclosed and must not be assumed.

1. Reconnaissance / target identification. An attacker identifies a Nextcloud instance that exposes the richdocumentscode app and therefore the proxy.php endpoint. Fingerprinting relies on the app's presence and the telltale behavior of the built-in CODE server. Shodan or similar scanners can locate Nextcloud instances with the download/CODE integration exposed.

2. Establishing the trigger condition. The attacker must reach the endpoint while the CODE server is not running. Because the description ties this to recent restarts, an attacker could either time an attack to coincide with an anticipated restart window (maintenance, upgrades, reboots) or induce a restart through unrelated means. Any window during which the CODE server is down (post-update, post-crash, or post-restart) exposes the vulnerable code path in proxy.php.

3. Triggering the OS command injection. With the precondition met, the attacker sends a crafted request to proxy.php. The command-injection condition allows attacker-controlled input to be interpreted by the underlying operating system shell rather than being treated as inert data. At the class level, this permits execution of arbitrary shell commands with the privileges of the web server / app runtime user.

4. Post-exploitation impact. Successful injection yields remote code execution. Given the Nextcloud context, an app-level RCE typically compromises the web application's host process, enabling data exfiltration of Nextcloud-hosted documents, credential theft, lateral movement into the hosting infrastructure, and possible full server compromise depending on the runtime privileges and containerization of the deployment.

The absence of authentication requirements is not explicitly stated in the NVD description, so analysts should not assume pre-auth exploitability. What is confirmed is remote code execution via command injection, actively exploited, under a runtime-specific precondition.

Impact Assessment

The CVSS vector provided in the raw data is reported as N/A, so a vendor-assigned score is not available for this CVE. The vector shown in the metadata above (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is an analytical estimate reflecting remote reachability, low attack complexity, and high confidentiality, integrity, and availability impact — it should be treated as an approximation, not a vendor-confirmed rating.

Business impact of OS command injection leading to RCE on a document-collaboration server is severe. Nextcloud deployments host sensitive files, shared documents, and often integrate with enterprise identity and storage. Compromise of the server endangers confidentiality of all hosted data, allows tampering with documents, and provides an execution foothold for lateral movement into the broader network. The in-the-wild exploitation observed in September and October 2026 confirms that real adversaries are already weaponizing this flaw. EPSS is 0.01225 (68.3rd percentile), indicating moderate near-term exploitation likelihood relative to other exploited CVEs, while the confirmed active exploitation elevates operational urgency regardless of the percentile. CISA KEV status is NO, meaning no federal remediation deadline applies, but this does not diminish the risk.

The blast radius is limited to Nextcloud deployments that bundle the built-in CODE server via richdocumentscode; standalone Collabora Online installations are explicitly unaffected. This scoping is important for asset prioritization.

Detection Guidance

Sigma Rule

title: Potential OS Command Injection in Collabora CODE Server proxy.php
id: 8f3c1a42-7b6e-4d21-9c5a-2026cve110447
status: experimental
description: Detects suspicious request patterns targeting the richdocumentscode proxy.php endpoint consistent with OS command injection attempts against CVE-2026-110447.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110447
author: Valters IT Threat Intelligence
date: 2026/11/01
tags:
  - attack.t1190
  - attack.execution
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains: 'richdocumentscode'
  selection_proxy:
    cs-uri-stem|endswith: '/proxy.php'
  selection_payload:
    cs-uri-query|contains:
      - ';'
      - '|'
      - '&&'
      - '`'
      - '$('
      - 'wget '
      - 'curl '
      - 'whoami'
      - '/bin/sh'
      - '/bin/bash'
  condition: selection_proxy and (selection_payload or selection_path)
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate document proxy parameters containing escaped characters (rare)
  - Security scanners performing authorized testing
level: high

YARA Rule

rule CVE_2026_110447_CODE_Proxy_Command_Injection
{
    meta:
        description = "Detects command-injection payload patterns in requests/logs targeting Collabora CODE Server proxy.php (CVE-2026-110447)"
        author = "Valters IT Threat Intelligence"
        date = "2026-11-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110447"
        severity = "high"

    strings:
        $proxy = "proxy.php" nocase ascii wide
        $app   = "richdocumentscode" nocase ascii wide
        $cmd1  = "$(" ascii wide
        $cmd2  = "`" ascii wide
        $cmd3  = "/bin/sh" nocase ascii wide
        $cmd4  = "/bin/bash" nocase ascii wide
        $cmd5  = "wget " nocase ascii wide
        $cmd6  = "curl " nocase ascii wide
        $cmd7  = "whoami" nocase ascii wide
        $cmd8  = "cmd.exe" nocase ascii wide

    condition:
        ($proxy or $app) and any of ($cmd*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110447 Collabora CODE Server proxy.php OS Command Injection Attempt"; flow:established,to_server; http.uri; content:"proxy.php"; nocase; http.uri; content:"richdocumentscode"; nocase; http.uri; pcre:"/(%3B|;|%7C|\||%26%26|&&|%60|`|\$\(|%24%28)/i"; threshold:type both, track by_src, count 3, seconds 60; classtype:web-application-attack; reference:cve,2026-110447; sid:11044701; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [network where url.path like "*proxy.php*" and url.path like "*richdocumentscode*"]
  [any where process.name in ("sh","bash","dash") or
       process.command_line like "*whoami*" or
       process.command_line like "*wget*" or
       process.command_line like "*curl*"]

Splunk SPL Query

index=web OR index=proxy
(uri_path="*proxy.php*" OR uri="*proxy.php*") AND uri_path="*richdocumentscode*"
| eval suspicious_chars=if(match(uri_query, "(;|\||&&|`|\$\(|%3B|%7C|%60)") OR match(uri_query, "(whoami|wget|curl|/bin/(sh|bash))"), "YES", "NO")
| where suspicious_chars="YES"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_query) as payloads by src_ip, uri_path, status
| sort - count

Wazuh OSSEC Rule

<group name="web,cve_2026_110447,">
  <rule id="110447" level="12">
    <if_sid>31100</if_sid>
    <id>^110447$</id>
    <match>proxy.php</match>
    <regex type="pcre2">(?i)(richdocumentscode).*?(proxy\.php)</regex>
    <description>CVE-2026-110447: Possible OS command injection attempt against Collabora CODE Server proxy.php</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_scan,cve_2026_110447,</group>
  </rule>

  <rule id="110448" level="10">
    <if_sid>110447</if_sid>
    <regex type="pcre2">(?i)(%3B|;|%7C|\||%26%26|&&|%60|`|%24%28|\$\(|whoami|wget|curl|/bin/(sh|bash))</regex>
    <description>CVE-2026-110447: Command injection payload characters detected in proxy.php request</description>
    <group>web_attack,cve_2026_110447,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list was provided in the tracked data; the version ceiling of 26.4.303 comes from the NVD description itself.

1. Immediate mitigations.

   • Restrict network access to any exposed Nextcloud instances running richdocumentscode. Place them behind authentication, VPN, or IP allow-listing where feasible.
   • Where the built-in CODE server integration is not business-critical, consider disabling the richdocumentscode app to remove the vulnerable proxy.php code path entirely.
   • Monitor for and reduce CODE server downtime windows. Since exploitation requires the CODE server to be not running, minimizing uncontrolled restarts and crash-induced outages narrows the exposure window.
   • Deploy the detection rules above at the WAF, IDS, and log-aggregation layers.

2. Patch/upgrade steps.

   • Upgrade the richdocumentscode Nextcloud app to version 26.4.303 or later, which the NVD description identifies as the version in which the flaw is addressed.
   • Verify the deployed app version via Nextcloud's app management interface or occ tooling after upgrading.
   • Confirm with the Collabora/Nextcloud advisories whether additional configuration changes accompany the fix, as no vendor advisory details were available in tracked sources.

3. Long-term hardening.

   • Migrate from the embedded CODE server to a standalone Collabora Online deployment, which the NVD description states is not affected by this vulnerability.
   • Apply least-privilege runtime isolation (containers, restricted service accounts) to limit the impact of any future command-injection flaw.
   • Maintain a vulnerability-management process that tracks actively exploited CVEs even when they are absent from CISA KEV, given the in-the-wild exploitation confirmed for this CVE.

References

• NVD — CVE-2026-110447: https://nvd.nist.gov/vuln/detail/CVE-2026-110447
• CWE-78 — Improper Neutralization of Special Elements used in an OS Command: https://cwe.mitre.org/data/definitions/78.html
• Collabora Online / CODE server product information: https://www.collaboraonline.com/
• Nextcloud app (richdocumentscode) documentation: https://apps.nextcloud.com/
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Exploit-in-the-wild evidence: NVD reports that this vulnerability was exploited in the wild during September and October 2026. No specific threat actor, campaign name, or malware family is attributed in the available data. CISA KEV status: not listed. No public PoC, Nuclei template, or exploit code is available in tracked sources.