This article was collected and archived by Digital Sovereignty Watch from an institutional or public source relevant to digital sovereignty, technology policy, cybersecurity, cloud services, artificial intelligence or European regulation.
Cybersecurity
Critical Vulnerability in Collabora Online – Built-in CODE Server
A critical OS command injection vulnerability has been discovered in the Nextcloud platform application Collabora Online – Built-in CODE Server (richdocumentscode) — CVE-2026-110447 (CVSS score: 9.2). Under certain conditions, the vulnerability in the proxy.php component allows an unauthenticated attacker to execute arbitrary operating system commands on the server. The vulnerability can be exploited when the CODE Server is not running, for example after a service restart. The vulnerability is already being actively exploited in real-world cyberattacks. It is recommended to update Collabora Online – Built-in CODE Server immediately to version 26.4.303 or later. https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516