NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksUpdated

Nextcloud's Built-in CODE Server (Collabora) command injection CVE-2026-110447 used in attacks; update to 26.4.303

Attackers are using a critical flaw in Nextcloud's optional Built-in CODE Server app (richdocumentscode) to plant web shells. Update it to 26.4.303 or remove it; disabling is not enough. Check for unknown PHP files if it was exposed.

What to do

If you run Nextcloud with the Built-in CODE Server app, update richdocumentscode to 26.4.303 or later in the app store, or remove it; disabling it is not enough. Then look in apps/richdocumentscode/ for PHP files you don't recognise, and ask whoever runs your server to check logs back to 10 September.

What’s happening

CVE-2026-110447 is an unauthenticated command injection flaw in richdocumentscode, the optional Built-in CODE Server app for Nextcloud that runs Collabora Online. A crafted request to the app's proxy.php file can run commands as the web server user, but only while the built-in server is not running, for example after a restart, upgrade or crash. Collabora rates it critical (CVSS v4 9.2). Versions before 26.4.303 are affected. Standalone Collabora Online servers, Docker and RPM/DEB installs and Nextcloud All-in-One are not. Collabora released the fix on 11 September 2026, but published its advisory only on 14 October. Administrators reported attacks from about 10 September, and attackers planted PHP web shells and looked for password-manager and crypto-wallet files. CISA listed the flaw as exploited on 23 October. Updating closes the hole but does not remove a web shell already installed. How many servers were hit is not known, and one report of ransomware use is unconfirmed.

What
Flaw
Affects
Nextcloud Built-in CODE Server app (richdocumentscode, Collabora Online)
Affected
richdocumentscode (Collabora Online - Built-in CODE Server) versions before 26.4.303
Fixed in
26.4.303
CVE
CVE-2026-110447
Since
23 Oct 2026

Timeline

  1. CISA added

    CISA adds CVE-2026-110447 to its Known Exploited Vulnerabilities list. Fixed versions are those from 26.4.303.

  2. Update

    eSecurity Planet reports attackers planting web shells and searching for password-manager and crypto-wallet files. Reviewed reports show no root access. Patching does not remove an existing web shell.

  3. Update

    BleepingComputer reports the attacks. Collabora blames the delay between fix and advisory on GitHub CVE-processing backlogs. Nextcloud says it had not seen widespread exploitation, which the October forum thread contradicts.

  4. Made publicFixed

    Collabora publishes its security advisory and the CVE is issued, rating the flaw critical (CVSS v4 9.2). The advisory says disabling the app is not enough: update to 26.4.303 or remove it.

  5. Wider attacks

    A Nextcloud forum member posts a warning to update the Built-in CODE Server app straight away. Users in the thread report finding web shells on their servers.

  6. New fixFixed

    Collabora releases richdocumentscode 26.4.303, which fixes the flaw. The fix was committed on 9 September, according to BleepingComputer.

  7. Wider attacks

    Nextcloud administrators report the earliest signs of attack: web shells appearing on their servers. Reports of attacks continue through mid-September.

Sources

  1. Unauthenticated OS command injection in the richdocumentscode proxy (GHSA-g3vx-3m76-fghh)Collabora Online · 14 Oct 2026
  2. To Collabora built-in user: update ASAPNextcloud community forum · 3 Oct 2026
  3. Hackers exploit Collabora RCE flaw to backdoor Nextcloud serversBleepingComputer · 15 Oct 2026
  4. Hackers Use Critical Collabora Flaw to Compromise Nextcloud ServerseSecurity Planet · 20 Oct 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from October 2026 · JSON · RSS