CVE-2026-110447: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
The Collabora Online Built-in CODE Server, the `richdocumentscode` app for Nextcloud, has an OS command injection in `proxy.php` that gives unauthenticated remote code execution. It is exploited in the wild and listed in CISA's KEV catalog. Version 26.4.302 and older are affected. Update to 26.4.303, then check for web shells.
Published Oct 14, 2026 · Updated Oct 24, 2026 · Analysis Oct 23, 2026
What an attacker can do
When the built-in CODE server is not running, for example after a restart, proxy.php starts it through a PHP exec call and builds the command from request input. A remote attacker needs only network access to the Nextcloud web server and no login. Attackers send GET requests to /apps/richdocumentscode/proxy.php using command substitution and path traversal, and the injected commands run as the web server user.
Reports in the maintainers' issue thread and the Nextcloud forum show the pattern: injected commands drop PHP web shells such as shx*.php files into the app directory. A typical shell runs shell_exec on a c parameter. From there the attacker can read anything the web server account can read, including Nextcloud config, database credentials, app passwords and user files.
The flaw is not in standalone Collabora Online servers, and not in Docker or distribution-package Collabora, or hosted Collabora services. It exists only in the Nextcloud app that bundles the CODE server in Built-in mode. Exploitation was seen in September and October 2026.
Who is affected
Affected: richdocumentscode (Collabora Online - Built-in CODE Server) before 26.4.303; reports name 26.4.302 and older. Not affected: setups using richdocuments without richdocumentscode, Collabora run through Docker or a distro package, and hosted services. Find the installed version in the Nextcloud app list, or run:
php occ app:list | grep richdocumentscodeHow to fix it
Update the Built-in CODE Server app to 26.4.303 or later from the Nextcloud app list. The maintainers confirmed 26.4.303 fixes the issue. If you cannot update, disable or remove the app. It is not needed when you use an external Collabora server.
CISA's required action: apply mitigations per vendor instructions and follow BOD 26-04 and CISA's forensics triage requirements, or stop using the product if mitigations are unavailable. The KEV due date is 2026-10-26 and binds US federal agencies. Updating does not remove a web shell already dropped, so check for compromise.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
How to tell if you were hit
Search web server logs, back to September 10, for requests to /apps/richdocumentscode/proxy.php containing %2e%2e, %24%28, $(, ${IFS} or base64 -d|sh. Run the Nextcloud integrity check and look for unexpected PHP files in apps/richdocumentscode, such as shx*.php, shrf* or Nx_*.php. Check for outbound calls to webhook.site and to 139.28.18.122 or 89.38.98.50, and for coolwsd processes with odd remote_font_config.url arguments. If you find a shell, rotate the database password, app passwords and any secrets the web server user could read. Most of these indicators come from community reports and are not official guidance.
Original advisory
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
Questions
- Is CVE-2026-110447 exploited in the wild?
Yes. CISA added it to the KEV catalog on 2026-10-23, and the CVE text says exploitation began in September and October 2026. Forum users report finding web shells.
- Is my standalone Collabora Online server affected?
No. The flaw is only in the Nextcloud Built-in CODE Server app. Collabora via Docker, a Linux package or a hosted service is not affected.
- Does updating to 26.4.303 clean up an earlier compromise?
No. The update closes the hole but leaves any dropped files. Check for unexpected PHP files, run the integrity check and rotate credentials the web server could read.
- Does it matter that the CODE server is not running?
Yes. The injection happens in
proxy.phpwhen the CODE server is down, such as after a restart, upgrade or crash.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. The analysis is written by an AI model from the sources listed above and checked by automated rules before it is published. Check versions against the vendor's advisory before you act. Methodology