Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-110447
By Roy Kalfon |
18 October 2026
CVE-2026-110447 – Nextcloud Collabora Built-in CODE Server command injection in proxy.php enables unauthenticated RCE
richdocumentscode (Collabora Online Built-in CODE Server) before 26.4.303 allows unauthenticated OS command injection in proxy.php when the local CODE server is not running (e.g., after restart/upgrade/crash). Remote attackers can execute arbitrary commands and deploy web shells. Standalone Collabora Online servers are not affected. Upgrade to 26.4.303+ to mitigate.