Attackers are exploiting a critical command execution flaw in the Collabora Online app for Nextcloud to plant webshells on servers. The bug, now tracked as CVE-2026-110447, has been under active exploitation since mid-September, a full month before the formal advisory went public. Admins running the built-in CODE server app need to update or remove it right away.
How the Collabora RCE flaw works
The flaw sits in the Collabora Online – Built-in CODE Server app (richdocumentscode) for Nextcloud, the optional app that runs a bundled Collabora server on the same machine. It affects versions before 26.4.303 and lives in the code that starts the bundled server. The attack is simple: a malicious request is sent to the app’s _proxy.php_ endpoint, and OS command injection happens from there. No authentication and no user interaction is needed.
One condition must be true for the attack to land: the built-in CODE server must be stopped at that moment, for example after a restart, an upgrade, or a crash. Only the optional built-in CODE server app is affected. Standalone Collabora Online servers, Docker and RPM/DEB installations, and Nextcloud All-in-One deployments are safe, according to Collabora.
What attackers did after getting in
Admins on the Nextcloud forums reported attacks against multiple endpoints going back to September 10. Once inside, the attackers planted PHP webshells and used them to search the server for password databases, password manager artifacts, and cryptocurrency wallets. Some users also reported ransomware operators using the flaw, though that could not be independently confirmed.
The fix was committed on September 9 and version 26.4.303 shipped on September 11, but the GitHub advisory and CVE were only published on October 14, a gap of more than four weeks. A community warning went up on October 3 urging admins to update, but without a CVE ID many teams did not spot it. A study from Second Security found the median gap between a public fix and CVE publication has grown to 39 days, up from 5.1 days in January, with AI-assisted vulnerability discovery straining CVE processing.
What admins should do now
Upgrade richdocumentscode to version 26.4.303 or later, or remove the built-in CODE server app entirely if you do not use it. Collabora warns that just disabling the app is not enough. If you ran an older version, check your server for unfamiliar PHP files, review access logs for requests to _proxy.php_, and rotate any credentials stored on the machine.
FAQ
What is CVE-2026-110447?
It is an OS command injection flaw in the Collabora Online built-in CODE Server app for Nextcloud (richdocumentscode versions before 26.4.303) that lets attackers run commands on the server without logging in.
Is my Nextcloud server affected?
Only if you use the optional built-in CODE Server app. Standalone Collabora Online servers, Docker, RPM/DEB installs, and Nextcloud All-in-One are not affected.
How do I patch the Collabora Nextcloud flaw?
Update richdocumentscode to version 26.4.303 or newer from the Nextcloud app store. Removing the app also works. Disabling it is not sufficient.
How were the Nextcloud servers attacked?
Attackers sent malicious requests to the app’s proxy.php endpoint while the bundled CODE server was stopped, triggered command injection, and installed PHP webshells to steal data.
