AI analysis
Collabora Online Built-in CODE Server (the Nextcloud richdocumentscode app) before 26.4.303 has an OS command injection in proxy.php that can lead to remote code execution. The flaw is reachable without authentication when the built-in CODE server is not running, such as shortly after a restart. A successful attacker can run operating-system commands on the Nextcloud host with the privileges of the web application. Only this built-in CODE deployment is affected; standalone Collabora Online servers are not, and the issue is distinct from CVE-2025-66208. It was exploited in the wild in September and October 2026; no public proof-of-concept is known and it is not listed in CISA KEV.
What to do: Upgrade the Nextcloud richdocumentscode (Built-in CODE Server) app to 26.4.303 or later. Because this was exploited in the wild, review servers that were restarted or left with CODE not running for unexpected processes, new admin users, webshells, and outbound connections, and isolate any host that shows signs of compromise. Standalone Collabora Online is not affected by this issue.
Affected
| Collabora Online Built-in CODE Server (richdocumentscode Nextcloud app) | before 26.4.303 |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.