pwned.coffeeOrder ticket · today's special · 23 Oct 2026

🔥 On the fly · exploited in the wildKEV due in 3dHell brew · 540°CcriticalOrder up · fix available

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Collabora Collabora Online – Built-in CODE Server

Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running. Added to CISA KEV on 2026-10-23 (federal deadline 2026-10-26).

First seen: 23 Oct 2026
Last update: 23 Oct 2026, 20:17 UTC
Identifiers: CVE-2026-110447
CVSS: 9.2
KEV deadline: 2026-10-26
Source: CISA KEV

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
Severity: critical, exploited in the wild. Patch status: patched.
Affected: Collabora Collabora Online – Built-in CODE Server
Ids: CVE-2026-110447

Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running. Added to CISA KEV on 2026-10-23 (federal deadline 2026-10-26).

## Steps
1. Search the repo, its CI and infra config for Collabora Collabora Online – Built-in CODE Server. If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-110447") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516 https://nvd.nist.gov/vuln/detail/CVE-2026-110447 https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0
https://pwned.coffee/i/collabora-online-built-in-code-server-os-command-injecti-cve-2026-110447

Timeline

23 Oct 2026, 20:17 UTC
Added to CISA's Known Exploited Vulnerabilities Catalog
23 Oct 2026
First reported.

Sources

Totalone very hot coffee