Nextcloud's built-in Collabora app: exploited for six weeks, CVE'd for ten days

Call: Patch now. CVE-2026-110447 is unauthenticated command injection in the optional “Collabora Online - Built-in CODE Server” Nextcloud app (richdocumentscode). Admins reported attacks going back to Sept 10, and CISA added it to KEV on Oct 23.

Fixed in: richdocumentscode 26.4.303, released Sept 11. The advisory and CVE didn’t appear until Oct 14, so if your scanner stayed quiet in September, that’s why.

How it works: A request to the app’s proxy.php injects OS commands, but only while the bundled CODE server is stopped. Attackers have been dropping PHP web shells and hunting for password databases, password-manager files and crypto wallets.

Who’s hit: Self-hosted Nextcloud with the built-in CODE app. Collabora says standalone Collabora Online, Docker and RPM/DEB installs, and Nextcloud All-in-One aren’t affected.

Do: Update to 26.4.303 or later, or remove the app. Disabling it isn’t enough. Then look in apps/richdocumentscode for PHP files you didn’t put there, and check proxy.php requests back to Sept 10. On Nextcloud 29 or older, upgrade Nextcloud or remove the app.

Sources: BleepingComputer, GitHub advisory, The Hacker News.