Critical OS Command Injection in Collabora Online Built‑in CODE Server (CVE‑2026‑110447) Enables Unauthenticated Code Execution

What happened

The `proxy.php` script in Collabora Online Built‑in CODE Server (versions ≤ 26.4.302) concatenated request data into a Bash command without sanitization. When the built‑in CODE server is stopped, attackers can send crafted requests that execute arbitrary OS commands as the web‑server user, leading to web‑shell deployment and credential harvesting.

Why it matters for trust and compliance

• The incident tests the control objective of continuous vulnerability management and secure configuration, a single control that maps to many frameworks (e.g., NIST CSF Identify and Protect). Demonstrating timely patching and evidence of remediation strengthens audit readiness and trust with enterprise buyers.
• Provides a concrete example of why continuous vulnerability‑management evidence is essential for audit readiness.
• Shows how mapping remediation steps to a control framework creates defensible proof for regulators and customers.

Who is affected

Recommended actions

1. Upgrade to Collabora Online Built‑in CODE Server 26.4.303 or later.
2. Delete any leftover `shx*.php` files after the upgrade.
3. Implement automated monitoring of `proxy.php` request patterns and retain logs for audit purposes.
4. Record the remediation steps in your Trust Center to demonstrate control compliance.

Details

CVEs

CVE-2026-110447