Collabora / Nextcloud Collabora Online… · Exploitation confirmed

CISA confirms active exploitation of critical Collabora CODE flaw in Nextcloud

Sep 09, 2026 · 1 min read

CVE-2026-110447 is an unauthenticated OS command injection (CVSS 9.2) in proxy.php of the richdocumentscode app, the Collabora Online Built-in CODE Server for Nextcloud. It has been exploited in the wild since September 10, 2026, with webshell installation, and CISA added it to the KEV catalog. Upgrade to 26.4.303 or later (latest: 26.4.502) or remove the app; disabling it is not enough.

By HIFY Radar newsroom Updated 10/26/2026 02:39 PM Get this every day →← Back to the feed 7 sources

CriticalVulnerabilityExploitation confirmedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

CISA added CVE-2026-110447 to the Known Exploited Vulnerabilities (KEV) catalog, confirming real-world attacks. The critical flaw lets attackers run commands on the server without credentials through the built-in Collabora CODE app for Nextcloud. Attacks have occurred since September 10, 2026 and install webshells.

Why it matters

Nextcloud servers running an outdated richdocumentscode app may have been breached. In reported cases, attackers installed webshells and searched for password vaults and cryptocurrency artifacts; anything the web server account can access should be treated as exposed. Standalone Collabora Online servers are not affected.

What to do

Upgrade the richdocumentscode app to 26.4.303 or later (latest: 26.4.502), or uninstall the app; disabling it does not remove the risk. On exposed servers, review logs since September 10, 2026, hunt for the reported webshells, and rotate credentials and secrets accessible to the web server.

For the technical team

CVE: CVE-2026-110447
Affected: Collabora / Nextcloud Collabora Online Built-in CODE Server (app richdocumentscode) para Nextcloud · richdocumentscode (Collabora Online Built-in CODE Server for Nextcloud) before 26.4.303; version compromised in reports: 26.4.302. Standalone Collabora Online servers are not affected; per Collabora, it only impacts the Development Edition in this deployment mode that downloads a local appimage. Users of EOL Nextcloud <= 29 should upgrade Nextcloud or remove the app.
Exploitation: Active exploitation reported since September 10, 2026, with webshell installation, confirmed in richdocumentscode issue #354, by press (BleepingComputer, The Hacker News) and by CISA, which added the CVE to KEV. The GitHub advisory cites in-the-wild exploitation in September and October 2026; EPSS of 11.634%.
Fix: Upgrade to richdocumentscode 26.4.303 or later; latest release: 26.4.502; or uninstall the app. Disabling the app is not sufficient. This is not the same path as CVE-2025-66208, whose fix does not prevent this flaw.
Vector: Unauthenticated OS command injection (CWE-78) in proxy.php of the richdocumentscode app (Collabora Online Built-in CODE Server). A remote request causes an operating system command to run as the web server user. Network exploitable with no privileges and no user interaction; the requirement is that the built-in CODE server is not running, such as after a container restart, an upgrade, or a crash (CVSS 4.0: AV:N/AC:L/AT:P/PR:N/UI:N).
More details: Reported by wwwshellcodeit; advisory GHSA-g3vx-3m76-fghh published October 14, 2026. Attacks use encoded path traversal (%2e%2e), command substitution $, ${IFS} whitespace obfuscation, and base64 shell payloads, with callbacks to webhook.site. The attacker ran discovery commands targeting *.kdbx, wallet.dat, keystore.json, bitwarden, 1password.bitcoin.electrum.monero, and .ethereum; reviewed logs showed no explicit archiving, uploading, or exfiltration commands, but anything accessible to the web server account must be treated as potentially affected. Exploitation only works while the built-in CODE server is not running (restart, upgrade, or crash).