Collabora CODE Server CVE-2026-110447: exploited RCE, how to fix it

TL;DR

• What: CVE-2026-110447 lets attacker input reach a shell command through proxy.php in the Collabora Online Built-in CODE Server, the richdocumentscode app that Nextcloud uses to edit documents.
• Impact: an unauthenticated attacker on the network can run commands on the server, and the trigger is a CODE server that is not running, for example after a restart.
• Severity: a CVSS v3.1 base score of 9.8 (critical) from NVD, weakness class CWE-78.
• Exploited: yes. CISA added it to the Known Exploited Vulnerabilities catalogue on October 23, 2026, with a due date of October 26, 2026.
• Fix: update the Built-in CODE Server to 26.4.303 or later. Standalone Collabora Online servers are not affected.

What CVE-2026-110447 is

Collabora Online is an office suite that runs in the browser. Nextcloud can embed it through the Built-in CODE Server, which ships as the richdocumentscode app so that a Nextcloud administrator does not have to run a separate document server. The app includes a small PHP file, proxy.php, that passes requests from the web server to the document engine.

The National Vulnerability Database classes the flaw as command injection into the operating system, reachable through that file. It can be reached when the CODE server is not running, which is the state you are in right after the product has been restarted. In that state an attacker can send input that ends up in a command executed by the host, so the result is remote code execution with the privileges of the web server process. The weakness is tracked as CWE-78.

Two details matter for scoping. First, standalone Collabora Online servers do not contain the bug, so the exposure is limited to Nextcloud installs that use the built-in server. Second, every release older than 26.4.303 is in the affected range.

Why it matters now

This is not a theoretical bug. The National Vulnerability Database says the flaw was exploited in the wild, and CISA added it to its Known Exploited Vulnerabilities catalogue on October 23, 2026 with a remediation due date of October 26, 2026. That due date has already passed. The NVD entry was published on October 14, 2026 and last updated on October 30, 2026, and its status is Analyzed.

The CISA entry lists known ransomware campaign use as unknown. Its required action is to apply mitigations in line with the vendor's instructions, or to stop using the product if no mitigations are available. A Nextcloud server that is reachable from the internet and edits documents through the built-in server is exactly the kind of system that attackers scan for, and the flaw needs no credentials, so there is little time between exposure and compromise.

The same pattern showed up in our earlier coverage of an exploited GitLab flaw: an unauthenticated remote code execution bug in a collaboration tool that many teams run on a server they rarely look at.

Am I affected?

You are affected if you run Nextcloud with the richdocumentscode app (the Collabora built-in document server) at any version older than 26.4.303. You are not affected by this CVE if your documents are served by a standalone Collabora Online server.

To check one machine by hand, ask Nextcloud which apps are installed and at which version, then look for the app on disk:

sudo -u www-data php occ app:list | grep -i -A1 richdocumentscode
sudo -u www-data php occ app:list | grep -i richdocuments
find / -type d -name richdocumentscode 2>/dev/null
grep -i version /path/to/nextcloud/apps/richdocumentscode/appinfo/info.xml

The first two commands show whether the built-in server and the Collabora connector app are enabled, and the version of each. The find command locates copies of the app that were unpacked by hand or are left over from a container image. The last command reads the version from the app metadata. Replace the path with your Nextcloud directory. If the version is older than 26.4.303, treat the server as vulnerable.

Remember images and containers. A Nextcloud container image can include the app, so a host package list will not show it. Check every Nextcloud instance, including test and staging systems that are reachable from the network.

How to fix CVE-2026-110447

The fix is to move the Built-in CODE Server to a release that is not in the affected range. Work through these steps in order:

1. List every Nextcloud instance that uses the Collabora Online Built-in CODE Server, and record the app version on each, using the commands above.
2. Update the richdocumentscode app to 26.4.303 or later from the Nextcloud app management page or with the occ command line tool, then confirm the new version is the one on disk and in the app list.
3. If you cannot update at once, disable the Built-in CODE Server app until you can, or restrict network access to the Nextcloud instance. CISA's required action says to stop using the product if mitigations are not available.
4. Look for signs of compromise on any server that was exposed while it was vulnerable. Check web server logs for unusual requests to proxy.php, look for new files and processes owned by the web server user, and rotate any credentials the server could read. CISA asks for forensics triage when exploitation may have happened.
5. Re-run your inventory check and confirm that no instance still reports a version before 26.4.303.

Our guide to remediation in Stackurity explains how upgrade cards list the version to move to and the issues each upgrade clears.

How to check with Stackurity

Stackurity keeps one live inventory of the software on your servers, deployed applications, repositories and container images. A read-only agent on Linux servers reads installed packages, runtimes installed by hand and the libraries that deployed applications actually load. That inventory is matched against new vulnerability advisories and the CISA Known Exploited Vulnerabilities catalogue every hour, and each finding says in one sentence why it applies and is ranked by exploitation, exposure and environment. An entry in the exploited catalogue pushes a finding to the top of the list.

After you apply a fix, the check again function asks the agent for a fresh report and records whether the issue is passed, partly fixed or still open, so you can prove the fix instead of assuming it. The verification guide describes that step.

Be clear about the limits. Stackurity does not assess libraries copied into an application outside a package manager or lockfile, apart from the front-end libraries it recognises by their version banner, and it does not cover network appliance firmware. A Nextcloud app that the application unpacks itself may be one of those cases, so use the hand check above to confirm each instance. The core is open source under Apache-2.0, and Stackurity Cloud has a 14-day free trial without a card: start a free trial.

FAQ

Is CVE-2026-110447 being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalogue on October 23, 2026, and the National Vulnerability Database says it was exploited in the wild. CISA lists known ransomware campaign use as unknown.

Which versions of the Built-in CODE Server are affected?

Every release before 26.4.303 of the Collabora Online Built-in CODE Server, the richdocumentscode app for Nextcloud. Standalone Collabora Online servers are not affected, only this deployment.

What is the fixed version for CVE-2026-110447?

Version 26.4.303 is the first release that is not in the affected range, so update to 26.4.303 or later. Confirm the exact release in the vendor advisory linked from the CISA catalogue entry.

How severe is CVE-2026-110447?

The National Vulnerability Database gives it a CVSS v3.1 base score of 9.8, rated critical. The weakness class is CWE-78, OS command injection.

Does Stackurity find the Built-in CODE Server?

Stackurity reads installed packages and the libraries that deployed applications load on Linux servers, and it matches them against advisories and the CISA catalogue. A Nextcloud app that is copied in by the application and not installed by a package manager may fall outside that, so confirm the version by hand as well.

Sources: CISA Known Exploited Vulnerabilities catalogue, NIST National Vulnerability Database and Stackurity product facts.