Collabora Online - Built-in CODE Server vulnerabilities

2 known vulnerabilities in Collabora Online - Built-in CODE Server from Collabora. 2 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Collabora Online – Built-in CODE Server OS Command Injection Exploited

  CVE-2026-110447Oct 14, 2026CollaboraEPSS 73.3%

  Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in

• 9.8 Critical severity

  online: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-66208Dec 3, 2025CollaboraOnlineEPSS 1.83%

  Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online. In versions prior to 25.04.702, Collabora Online has a Configuration-Dependent RCE (OS Command Injection) in r