Pulp-style warning robot with a red beacon reading a printout from a teletype machine

Collabora built-in CODE Server CVE-2026-110447: exploited on Nextcloud, upgrade or remove the app

ALERT · Actively exploited. Last updated 26 October 2026. See the Alert Tracker

If your Nextcloud runs the Collabora Online Built-in CODE Server app, upgrade it to 26.4.303 or remove it. Switching it off does not help. The flaw has been exploited since September, and CISA gave US federal agencies until today, 26 October, to act.

What it is

CVE-2026-110447 is an unauthenticated OS command injection in richdocumentscode, the Nextcloud app that bundles a built-in Collabora Online (CODE) server. The CVE record on NVD (opens in a new tab) says it “allows remote code execution, as exploited in the wild in September and October 2026”. CISA added it to the Known Exploited Vulnerabilities catalogue (opens in a new tab) on 23 October, the same day as Arista VeloCloud Orchestrator, and flags it for forensic triage.

Two conditions matter. Collabora’s security advisory (opens in a new tab) says the attack works only while the built-in CODE server is not running, for example after a container restart, an upgrade or a crash. When it works, commands run as the web server user, which can usually read Nextcloud’s configuration and data.

It is a different flaw from CVE-2025-66208. Collabora says the fix for that issue does not prevent this one, so an earlier patch is no comfort.

Scores

  • CVSS 4.0: 9.2 (Critical), from Collabora’s advisory and the CVE record. NVD has not scored it and lists the record as “Deferred”.

Who is affected

  • Affected: Nextcloud servers with the Collabora Online – Built-in CODE Server app (richdocumentscode) older than 26.4.303.
  • Disabled is still affected. Collabora: “It is not sufficient to disable the app to avoid the problem, it must be upgraded to >= 26.4.303 or removed.”
  • Old Nextcloud: on end-of-life Nextcloud 29 or earlier, upgrade Nextcloud or remove the app.
  • Not affected: standalone Collabora Online servers. Per the Nextcloud community forum thread (opens in a new tab) that CISA cites, Collabora run from Docker or a Linux distribution package, and hosted Collabora services, are not affected either.

What to do

  • Upgrade or remove. Update richdocumentscode to 26.4.303 or later, or uninstall it. Do not rely on disabling it.
  • Assume compromise if it was exposed. If a vulnerable version was reachable while the CODE server was down, hunt before you treat patching as the end of it.
  • Hunt for webshells. Look for unexpected PHP files, especially inside the app’s folder under apps/richdocumentscode/. Administrators on the Nextcloud forum found webshells this way, and one found an extra PHP file flagged by Nextcloud’s code integrity check after upgrading.
  • Check the logs. Review web server access logs back to early September for unexpected requests to the app’s proxy.php.
  • If you find one, treat the host as compromised: rebuild or restore from a known-good state, and rotate anything the web server user could read, such as database and app passwords.

Sources

Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)