{"id":"collabora-code-server-nextcloud-rce-oct-2026","category":"patch","status":"live","title":"Nextcloud's Built-in CODE Server (Collabora) command injection CVE-2026-110447 used in attacks; update to 26.4.303","tldr":"Attackers are using a critical flaw in Nextcloud's optional Built-in CODE Server app (richdocumentscode) to plant web shells. Update it to 26.4.303 or remove it; disabling is not enough. Check for unknown PHP files if it was exposed.","summary":"CVE-2026-110447 is an unauthenticated command injection flaw in richdocumentscode, the optional Built-in CODE Server app for Nextcloud that runs Collabora Online. A crafted request to the app's proxy.php file can run commands as the web server user, but only while the built-in server is not running, for example after a restart, upgrade or crash. Collabora rates it critical (CVSS v4 9.2). Versions before 26.4.303 are affected. Standalone Collabora Online servers, Docker and RPM/DEB installs and Nextcloud All-in-One are not. Collabora released the fix on 11 September 2026, but published its advisory only on 14 October. Administrators reported attacks from about 10 September, and attackers planted PHP web shells and looked for password-manager and crypto-wallet files. CISA listed the flaw as exploited on 23 October. Updating closes the hole but does not remove a web shell already installed. How many servers were hit is not known, and one report of ransomware use is unconfirmed.","action":"If you run Nextcloud with the Built-in CODE Server app, update richdocumentscode to 26.4.303 or later in the app store, or remove it; disabling it is not enough. Then look in apps/richdocumentscode/ for PHP files you don't recognise, and ask whoever runs your server to check logs back to 10 September.","product":"Nextcloud Built-in CODE Server app (richdocumentscode, Collabora Online)","audience":"both","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-110447"],"tags":["nextcloud","collabora","richdocumentscode","command-injection","web-shell","cisa-kev","self-hosted"],"affected":["richdocumentscode (Collabora Online - Built-in CODE Server) versions before 26.4.303"],"fixed":["26.4.303"],"matches":[],"sources":[{"kind":"advisory","title":"Unauthenticated OS command injection in the richdocumentscode proxy (GHSA-g3vx-3m76-fghh)","url":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh","by":"Collabora Online","date":"2026-10-14"},{"kind":"post","title":"To Collabora built-in user: update ASAP","url":"https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516","by":"Nextcloud community forum","date":"2026-10-03"},{"kind":"news","title":"Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers","url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/","by":"BleepingComputer","date":"2026-10-15"},{"kind":"news","title":"Hackers Use Critical Collabora Flaw to Compromise Nextcloud Servers","url":"https://www.esecurityplanet.com/threats/news-collabora-nextcloud-cve-2026-110447/","by":"eSecurity Planet","date":"2026-10-20"}],"started":"2026-10-23","closed":null,"created":"2026-11-03T22:05:17.997Z","updated":"2026-11-03T22:05:17.997Z","cve_notes":[{"cve":"CVE-2026-110447","name":"Command injection in Nextcloud's Built-in CODE Server","what":"An OS command injection in the proxy.php file of the Built-in CODE Server app that lets an unauthenticated attacker run commands as the web server user while the built-in server is not running.","severity":"critical","cvss":9.2}],"timeline":[{"at":"2026-10-23","added":"2026-11-03T22:00:26.134Z","kind":"cisa-added","text":"CISA adds CVE-2026-110447 to its Known Exploited Vulnerabilities list. Fixed versions are those from 26.4.303.","url":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh","by":"CISA","patch":null},{"at":"2026-10-20","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"eSecurity Planet reports attackers planting web shells and searching for password-manager and crypto-wallet files. Reviewed reports show no root access. Patching does not remove an existing web shell.","url":"https://www.esecurityplanet.com/threats/news-collabora-nextcloud-cve-2026-110447/","by":"eSecurity Planet","patch":null},{"at":"2026-10-15","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"BleepingComputer reports the attacks. Collabora blames the delay between fix and advisory on GitHub CVE-processing backlogs. Nextcloud says it had not seen widespread exploitation, which the October forum thread contradicts.","url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/","by":"BleepingComputer","patch":null},{"at":"2026-10-14","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"Collabora publishes its security advisory and the CVE is issued, rating the flaw critical (CVSS v4 9.2). The advisory says disabling the app is not enough: update to 26.4.303 or remove it.","url":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh","by":"Collabora Online","patch":"patched"},{"at":"2026-10-03","added":"2026-11-03T22:00:26.134Z","kind":"wider-attacks","text":"A Nextcloud forum member posts a warning to update the Built-in CODE Server app straight away. Users in the thread report finding web shells on their servers.","url":"https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516","by":"Nextcloud community forum","patch":null},{"at":"2026-09-11","added":"2026-11-03T22:00:26.134Z","kind":"new-fix","text":"Collabora releases richdocumentscode 26.4.303, which fixes the flaw. The fix was committed on 9 September, according to BleepingComputer.","url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/","by":"BleepingComputer","patch":"patched"},{"at":"2026-09-10","added":"2026-11-03T22:00:26.134Z","kind":"wider-attacks","text":"Nextcloud administrators report the earliest signs of attack: web shells appearing on their servers. Reports of attacks continue through mid-September.","url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/","by":"BleepingComputer","patch":null}],"url":"https://hard.fyi/live/collabora-code-server-nextcloud-rce-oct-2026/","json":"https://hard.fyi/api/live?id=collabora-code-server-nextcloud-rce-oct-2026"}