[Urgent] Nextcloud "Collabora Online - Built-in CODE Server" CVE-2026-110447: Update to 26.4.303 or Later, or Remove It (CVSS v4.0 9.2) — Exploited; Disabling the App Is Not Enough

The Nextcloud app "Collabora Online - Built-in CODE Server" (richdocumentscode) has a flaw that lets an unauthenticated attacker run OS commands as the web server user. It is CVE-2026-110447. The vendor advisory says it was exploited in the wild in September and October 2026, and CISA added it to KEV (its catalog of known exploited vulnerabilities) on 23 October.

You are affected if richdocumentscode is older than 26.4.303. The fix is 26.4.303; the latest release at the time of writing is 26.4.502 (23 October). The key point: disabling the app does not protect you. The advisory says you must upgrade to 26.4.303 or later, or remove the app.

A separate, standalone Collabora Online server is not affected. Only the setup where the CODE server is built into Nextcloud as an app is affected (vendor).

Where this score comes from. 9.2 is a CVSS v4.0 value with the vector `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N` (network, no authentication, no user interaction). NVD shows the value supplied by the CNA side (MITRE), and the vendor's GitHub advisory carries the same 9.2. NVD had not scored it itself as of its 24 October 2026 update (status "Deferred"). I found no v3.x score. The weakness type is CWE-78 (OS command injection).

The vector includes "AT:P" (attack requirements present). The attack works while the built-in CODE server is not running; the advisory gives a container restart, an upgrade or a crash as examples.

What to do now

• ✓★Check whether your Nextcloud has "Collabora Online - Built-in CODE Server" (richdocumentscode). You can see it in the admin apps list. If it is installed and older than 26.4.303, you are affected. A setup with only "Collabora Online" (richdocuments) that does not use the built-in server is not listed as affected
• ✓Update to 26.4.303 or later. The latest is 26.4.502 (23 October). Disabling does not protect you. Update or remove the app entirely (advisory)
• ✓Before updating, check whether you were already compromised. The vendor advisory lists no indicators of compromise. Users' reports describe unfamiliar PHP files in the app folder (apps/richdocumentscode), used as web shells (a back door that accepts commands from outside); the names `shrf4645.php`, `shxa35d0.php` and `Nx_33143.php` were reported. Names vary by attack, so be suspicious of any unfamiliar PHP file even if the name does not match (our note)
• ✓Look for suspicious requests in your access logs. In the GitHub report the attacks targeted `/apps/richdocumentscode/proxy.php?status` with `$(`, `${IFS}` and `%2e%2e` (an encoded "..") in the URL. Logs from around 10 September onward are what to check (user report)
• ✓If you suspect a break-in, change what the web server could read: database passwords, secrets in config files, app passwords (our note). For business servers, I suggest asking a specialist firm to investigate
• ✓If you run an end-of-life Nextcloud (version 29 or earlier), upgrade Nextcloud itself or remove this app. The advisory asks for this
• ✓After updating, also run Nextcloud's integrity check to see whether the app has extra files (our note). One user reported noticing an extra PHP file through the integrity scan after updating

What the flaw does

• ▸Where and what: `proxy.php` in the app has an OS command injection (CWE-78). An unauthenticated request may run OS commands as the web server user (vendor)
• ▸It is a different vulnerability from CVE-2025-66208. The advisory says the fix for the earlier CVE does not stop this one
• ▸Exploitation: the vendor says it was exploited in September and October 2026. CISA's assessment recorded in NVD is exploitation "active", automatable "yes", technical impact "total". Ransomware use is "Unknown" in the KEV field
• ▸CISA's due date is 26 October, and it also requires forensic triage. That is a condition for US federal agencies and does not bind organisations in Japan, but it signals that an investigation, not just an update, is expected

Timeline

• ▸Around 10 September: a GitHub reporter says this is when they saw attacks on their Nextcloud servers (report posted 11 September; user report)
• ▸11 September: the fixed version 26.4.303 was released (GitHub release)
• ▸3 October: a user warned on the Nextcloud forum that it was being exploited although no CVE existed yet (user post)
• ▸14 October: CVE-2026-110447 and the vendor advisory (GHSA) were published
• ▸23 October: CISA added it to KEV; the latest version 26.4.502 was released the same day

What I could not confirm

• ▸Official indicators of compromise from the vendor. The advisory has none. The file names and URL traits above come from users' reports and may not match every attack
• ▸Who is attacking, and at what scale. Neither the vendor nor public agencies have published victim numbers
• ▸NVD's own score and any v3.x score. NVD had not finished its assessment as of the 24 October 2026 update
• ▸Any mitigation other than updating or removing. The advisory says the attack works when the CODE server is not running, but gives no other reliable way to avoid it

Three lines to share

• ▸Nextcloud's "Collabora Online - Built-in CODE Server" (richdocumentscode) older than 26.4.303 allows unauthenticated OS command execution (CVE-2026-110447, CVSS v4.0 9.2). Exploitation is confirmed and CISA added it to KEV on 23 October
• ▸★Disabling the app does not help. Update to 26.4.303 or later, or remove it. Before and after, check the app folder for unfamiliar PHP files
• ▸If you were breached, change the passwords and secrets the web server could read. For business servers, ask a specialist firm to investigate