2026-10-25
Nextcloud built-in Collabora CODE server CVE-2026-110447 exploited: who is affected and what to do
On October 14, 2026, the Collabora Online developers disclosed CVE-2026-110447, an unauthenticated OS command injection vulnerability in the Nextcloud app Collabora Online - Built-in CODE Server (app ID richdocumentscode). Through the app's proxy.php, commands can run as the web server user. The condition is that the built-in CODE server is not running, which can happen after a container restart, an upgrade or a crash. Versions before 26.4.303 are affected; 26.4.303 was released on September 11. The developers say disabling the app does not prevent the problem and ask users to update or remove it. On end-of-life Nextcloud 29 and earlier, update Nextcloud or remove the app. The developers say standalone Collabora Online servers, Docker images, RPM/DEB packages and Nextcloud All-in-One are not affected. The CVSS v4.0 score is 9.2. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on October 23 with a due date of October 26. Users reported attacks from around September 10 in the developers' repository, and according to press reports web shells were planted. This site's conclusion: if the built-in CODE app is installed, even disabled, check its version today, update or remove it, then check for traces since September 10.