CyberSecBulletin

Collabora vulnerabilities

We track 2 vulnerabilities in Collabora products. 2 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on October 14, 2026.

2vulnerabilities
2critical
0high
1exploited
9.8average CVSS score

Latest Collabora vulnerabilities

  • 9.8 Critical severity

    Collabora Online – Built-in CODE Server OS Command Injection Exploited

    CVE-2026-110447CollaboraEPSS 73.3%

    Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in

  • 9.8 Critical severity

    online: Improper Neutralization of Special Elements used in an OS Command

    CVE-2025-66208CollaboraOnlineEPSS 1.83%

    Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online. In versions prior to 25.04.702, Collabora Online has a Configuration-Dependent RCE (OS Command Injection) in r