TechAtelier

CYBERSECURITY · OCTOBER 25, 2026

Nextcloud Collabora: actively exploited CVE-2026-110447

An OS command injection vulnerability in Nextcloud's optional Collabora Built-in CODE Server is being exploited. The affected deployment is specific, but prompt remediation matters.

What happened?

CVE-2026-110447 affects the optional Nextcloud richdocumentscode application, known as Collabora Online Built-in CODE Server. An OS command injection in proxy.php may allow unauthenticated remote code execution. Its published CVSS 4.0 severity score is 9.2/10.

Exploitation has been reported in September and October 2026. The CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on October 23, 2026.

Which deployments are affected?

The issue affects the Nextcloud Built-in CODE Server application before version 26.4.303. It does not affect all Nextcloud instances or standalone Collabora Online servers. Exploitation requires the built-in CODE server not to be running already, for example during a restart or following a crash.

This narrows the attack window but does not eliminate the threat. Inventory installed applications, including those that are currently disabled.

Recommended actions

  1. Inventory Nextcloud installations and identify the richdocumentscode app, which is distinct from richdocuments.
  2. Upgrade the Built-in CODE Server app to 26.4.303 or later following the vendor's instructions.
  3. If it is no longer needed, properly uninstall the app rather than relying solely on disabling it.
  4. For previously exposed deployments, review web server logs, unexpected files in the application directory and other indicators of compromise. An outdated version alone is not proof of intrusion.
  5. Verify collaborative editing and document access after remediation.

Why might disabling the app be insufficient?

Vulnerable application files may remain on disk when an app is disabled through the interface. Whether its vulnerable endpoint remains reachable depends on the deployment configuration. Follow vendor guidance and update or remove the component to address the vulnerable code.

TechAtelier's recommendation

Do not check only your Nextcloud core version. Inventory optional apps and their versions as well: additional components may run with significant server privileges.

Use TechAtelier Software Watch to help track the software components you operate.

Sources

Collabora — vendor guidance and patched version · NVD — CVE-2026-110447 and CISA KEV · Nextcloud — vendor update notice.