Critical Nextcloud Collabora Flaw Exploited, Patch Urged
Attackers are exploiting CVE-2026-110447 in the Collabora Online - Built-in CODE Server app for Nextcloud, allowing OS command injection without authentication.
Threat actors are exploiting a critical command execution vulnerability tracked as CVE-2026-110447 in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud, according to BleepingComputer. The flaw affects richdocumentscode versions before 26.4.303 and resides in the mechanism for starting the bundled Collabora server. Attacks involve sending a malicious request to the app's proxy.php endpoint, triggering OS command injection.
Exploitation requires the built-in CODE server to be stopped, and no authentication or user interaction is needed. The fix was committed on September 9, and version 26.4.303 was released on September 11. The advisory and CVE were published on October 14.
System administrators are recommended to upgrade to version 26.4.303 or later, or remove the server app. Nextcloud stated that Collabora reported the vulnerability in mid-September and that an update became available through the app store.
Collabora attributed the delayed announcement primarily to GitHub CVE-processing backlogs. In August, the median interval between public fixes and CVE publication was 39 days, up from 5.1 days in January, according to Second Security.
Quick answers
What is CVE-2026-110447?
It is a critical command execution flaw in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud, affecting versions before 26.4.303.
How can administrators fix the vulnerability?
They should upgrade to richdocumentscode version 26.4.303 or later, or remove the server app.
Does exploitation require authentication?
No, no authentication or user interaction is needed, but the built-in CODE server must be stopped.