Understanding CVE-2026-110447: Command Injection in Collabora Online CODE Server

Executive Summary

The Cybersecurity and Infrastructure Security Agency (CISA) recently updated its Known Exploited Vulnerabilities (KEV) Catalog by adding CVE-2026-110447. This vulnerability represents a critical OS command injection flaw located within the built-in CODE Server component of Collabora Online. Collabora Online is widely deployed as a self-hosted document editing suite integrated with platforms like Nextcloud, ownCloud, and custom enterprise portals.

Active exploitation of CVE-2026-110447 in the wild allows remote attackers to execute arbitrary system commands on exposed instances. Successful exploitation can lead to complete host compromise, unauthorized access to sensitive document stores, and lateral movement across internal corporate networks. Security teams must prioritize immediate inventory discovery, external surface scanning, and patching to mitigate risk across public-facing infrastructure.

Technical Details

Collabora Online relies on the Collabora Online Development Edition (CODE) engine or enterprise server architecture (coolwsd service) to process, render, and edit document formats including text documents, spreadsheets, and presentations. To perform these intensive rendering and conversion tasks, the service interacts directly with underlying system utilities and document parsing binaries.

CVE-2026-110447 stems from improper input sanitization within specific API endpoints and parameter handlers exposed by the CODE Server. When processing incoming user requests—such as specialized document conversion parameters or administrative health calls—the application fails to adequately sanitize control characters before invoking system execution functions.

Key technical aspects of this vulnerability include:

• Insecure Command Construction: User-supplied parameters are concatenated directly into operating system shell commands without sufficient escaping or validation.

• Unauthenticated Access Vector: Depending on the server deployment and proxy configuration, vulnerable HTTP or WebSocket endpoints can be reached directly by remote, unauthenticated clients on standard service ports.

• Process Context Execution: Shell commands injected via this vulnerability execute within the security context of the coolwsd daemon user or the container user in dockerized environments.

Because document processing servers frequently hold read and write handles to local or remote storage shares, command execution in this context poses a direct threat to data confidentiality and network integrity.

Exploitation & Risk

Threat actors routinely target self-hosted productivity tools and collaboration software because these platforms sit at the intersection of public internet connectivity and internal document repositories. In the case of CVE-2026-110447, active exploitation activity follows a predictable lifecycle:

• Automated Reconnaissance: Attackers scan public IPv4 and IPv6 spaces for web services exposing default Collabora paths, such as /browser/, /cool/, or open TCP port 9980.

• Payload Delivery: Malicious HTTP or WebSocket requests containing shell metacharacters (such as command separators, pipes, or command substitution constructs) are sent to vulnerable endpoints.

• Remote Command Execution: The underlying host executes the injected payload, enabling attackers to establish reverse shells, download staging scripts, or deploy persistent web shells.

Associated organizational risks include:

• Comprehensive Data Exfiltration: Direct access to stored documents, encryption keys, and integration credentials stored in environment variables or configuration files.

• Lateral Movement: Compromised document servers often serve as initial access vectors, allowing adversaries to pivot into internal cloud environments, storage buckets, or corporate Active Directory domains.

• Infrastructure Abuse: Hijacking system resources for cryptomining or utilizing compromised servers as proxy nodes for subsequent malicious activity.

Remediation & Defense

To effectively defend against CVE-2026-110447, security administrators and platform engineering teams should execute the following defensive measures:

• Apply Vendor Updates Immediately: Upgrade all Collabora Online and CODE Server installations to the latest official release provided by Collabora. Verify that all dependencies and underlying system packages are updated.

• Restrict Network Access: Limit public exposure of the CODE server. Ensure that the Collabora backend service (typically listening on port 9980) is accessible only by the trusted reverse proxy or application frontend (e.g., your Nextcloud instance) via strict network firewall rules or security groups.

• Enforce Least Privilege: Ensure the coolwsd daemon runs as an unprivileged, dedicated user account (cool). If running in Docker or Kubernetes, enforce non-root execution, apply read-only root filesystems where possible, and drop unnecessary Linux capabilities (CAP_SYS_ADMIN).

• Deploy Web Application Firewall (WAF) Rules: Implement WAF signatures designed to inspect HTTP traffic for shell metacharacters and anomalous string payloads targeted at document conversion endpoints.

• Conduct Forensic Audits: Review system execution logs (coolwsd.log), web access logs, and process activity on exposed servers. Inspect system temporary directories (/tmp, /var/tmp) for unauthorized scripts or unexpected outbound network connections.

How Mangudai Can Help

Detecting exposed and vulnerable instances before malicious actors exploit them requires continuous visibility into your organization's external attack surface. Mangudai's platform assists security teams in identifying potentially exposed Collabora Online deployments using non-intrusive reconnaissance capabilities:

• Subdomain Discovery: Mangudai systematically enumerates subdomains across your domain portfolio, uncovering forgotten or shadow IT assets hosting collaboration tools (e.g., office.example.com or collabora.dev.example.com).

• Port and Service Detection: Through its port module, Mangudai identifies open TCP ports commonly utilized by Collabora Online and custom web applications, including default service port 9980, HTTP (port 80), and HTTPS (port 443).

• Banner-Based Vulnerability Matching: Mangudai extracts HTTP server response headers, service banners, and HTML meta tags. It matches detected software versions against vulnerability intelligence databases, highlighting potential exposure to CVE-2026-110447.

It is important to note that Mangudai performs banner-based matching as an unverified exposure check. It identifies open ports, running services, and published version strings without executing exploit payloads or intrusive penetration tests. This safe detection method alerts your team to publicly exposed instances so you can patch or restrict access promptly.

Sources

• CISA Alert: CISA Adds One Known Exploited Vulnerability to Catalog