Critical RCE in Nextcloud Collabora Online Built-in CODE Server (CVE-2026-110447)

Affected Vendors

Collabora, Nextcloud

Affected Components

Collabora Online Built-in CODE Server (richdocumentscode)

Published Date

2026-10-14

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Collabora Online Built-in CODE Server (richdocumentscode) for Nextcloud before version 26.4.303.

Impact

Unauthenticated remote attackers can execute arbitrary OS commands, leading to full system compromise.

Mitigation

Update the richdocumentscode app to version 26.4.303 or later immediately.

Affected Products & Version Scope

All Nextcloud instances utilizing the 'Collabora Online Built-in CODE Server' app versions prior to 26.4.303.

Remediation & Live Workaround Commands

PATCH & WORKAROUND

The primary remediation is to upgrade the richdocumentscode app to version 26.4.303 or higher. Use the following Nextcloud OCC command:

bash

bash # Update via CLI php occ app:update richdocumentscode

If an immediate update is not feasible, disable the application to mitigate the risk:

bash

bash # Disable the vulnerable app php occ app:disable richdocumentscode

Ensure that your Web Application Firewall (WAF) is configured to inspect and block suspicious command patterns directed at the proxy.php endpoint.

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

Due to active exploitation and a high EPSS score (0.94), immediate patching to version 26.4.303 or later is mandatory.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

CVE-2026-110447 is a critical OS command injection vulnerability (CWE-78) residing in the proxy.php file of the Collabora Online Built-in CODE Server (richdocumentscode) app for Nextcloud. The flaw is triggered when the CODE server is not actively running (e.g., during a service restart or initial boot). During this window, insufficient input validation allows an attacker to inject malicious shell commands via crafted HTTP requests. This vulnerability has been actively exploited in the wild as of late 2026 and is officially listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It is distinct from CVE-2025-66208 and specifically affects the built-in Nextcloud app deployment, not standalone Collabora Online installations.

Official Vendor Advisories & References

NVD Original English Description

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.

https://github.com/CollaboraOnline/richdocumentscode/issues/354

Source: cve@mitre.org · Issue Tracking

https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516

Source: cve@mitre.org · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110447

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed: