Nextcloud Admins Must Patch Collabora CODE Server for Critical RCE
Threat actors are actively exploiting a command injection flaw in the built-in Collabora Online CODE Server app, allowing full system control without authentication.
Key points
- CVE-2026-110447 affects richdocumentscode versions before 26.4.303 in Nextcloud deployments using the bundled CODE Server.
- Attackers exploit the flaw via proxy.php when the server is stopped, requiring no authentication or user interaction.
- A fix is available in version 26.4.303; simply disabling the app is insufficient to mitigate the risk.
Managed service providers must immediately update Nextcloud instances running the Collabora Online Built-in CODE Server app. The National Vulnerability Database rates CVE-2026-110447 as critical with a CVSS score of 9.2. This flaw allows remote code execution through OS command injection in the proxy.php endpoint. The vulnerability exists only in the richdocumentscode app versions prior to 26.4.303. Standalone Collabora Online servers, Docker containers, and RPM or DEB installations are not affected by this specific issue.
How it unfolded
- Threat actors began exploiting the flaw in mid-September 2026, targeting Nextcloud administrators before any formal security bulletin was released.
- Administrators reported malicious requests hitting multiple endpoints starting around September 10, with attackers planting PHP webshells to search for credentials.
- A community warning urging immediate updates appeared on October 3, but the lack of a CVE ID initially hindered precise identification of the threat.
- The formal CVE publication and GitHub advisory followed roughly a month after the attacks began, confirming active wild exploitation.
Who is affected
Only Nextcloud environments using the optional built-in CODE Server app are at risk. According to Collabora, standalone Collabora Online servers and Nextcloud All-in-One deployments remain unaffected. The vulnerability triggers when the CODE server is not running, such as after a restart, upgrade, or crash. Successful exploitation requires no authentication or user interaction. Attackers have used this access to deploy webshells and hunt for password databases, password manager artifacts, and cryptocurrency wallets. Some reports suggest ransomware operators are also leveraging the flaw, though this remains unconfirmed.
Our take on the response
The delay between public exploitation and formal CVE publication highlights a growing gap in vulnerability tracking. Second Security research indicates the median interval between fixes and CVE publication rose to 39 days in August, up from 5.1 days in January. Researchers attribute this strain to increased volumes of AI-assisted vulnerability discoveries. For patch desks, this means relying solely on CVE IDs leaves systems exposed during the lag period. Proactive monitoring of vendor advisories and community warnings is essential to close this window.
Who needs to act first
Teams should prioritize updating Nextcloud instances that expose the richdocumentscode app to the internet or untrusted networks. Verify whether the built-in CODE Server is active and if it has recently restarted or crashed, as this state enables exploitation. Before applying the update, back up configuration files and databases to ensure rollback capability. Test the upgrade in a staging environment first to confirm compatibility with existing integrations. If the app is unused, remove it entirely rather than just disabling it, as disabling alone does not mitigate the risk.
What to do and how to stay safe: Collabora
- Verify if your Nextcloud instances run the richdocumentscode app version earlier than 26.4.303 and update to the latest release immediately.
- Remove the built-in CODE Server app entirely if it is not required for your organization's document collaboration workflows.
- Monitor server logs for suspicious activity around proxy.php endpoints, especially following server restarts or maintenance windows.
- Once the vendor provides an update, ensure all Nextcloud nodes in clustered environments are patched simultaneously to prevent inconsistent states.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this vulnerability affect standalone Collabora Online servers?
No, the flaw only affects the built-in CODE Server app (richdocumentscode) within Nextcloud; standalone servers and Docker installations are unaffected.
Is disabling the app enough to stop the attacks?
No, the vendor explicitly warns that disabling the app is insufficient; administrators must upgrade to version 26.4.303 or later or remove the app.
Do attackers need a user account to exploit this flaw?
No, authentication or user interaction is not required; the attack succeeds when the CODE server is stopped, such as after a restart.
