Collabora · Collabora Online – Built‑in CODE Server
Updated October 24, 2026
When the CODE server component is inactive within Nextcloud, a crafted request can trigger OS command injection, giving remote attackers the ability to execute arbitrary code on the host. This vulnerability surfaces in environments that rely on Collabora for online document editing.
Successful exploitation may lead to full system compromise, allowing attackers to install ransomware, create backdoors, or pivot to other services.
Upgrade to the patched Collabora Online version, ensure the CODE server is always running or disabled, and enforce strict input validation on Nextcloud integrations.
More active vulnerabilities