Collabora Online Built-in CODE Server for Nextcloud (CVE-2026-110447): Exploited Flaw Added to CISA KEV, Upgrade or Remove the App

CVE-2026-110447 is an unauthenticated OS command injection in Collabora Online - Built-in CODE Server, an optional Nextcloud app with the package name richdocumentscode. Collabora's advisory says a request to the app's proxy.php script can make the server run an operating system command as the web server user. The attack only works while the app's local CODE server is not running, for example during a container restart, an upgrade or after a crash. Collabora scores the flaw CVSS 4.0 9.2 (Critical). Versions before 26.4.303 are affected. Collabora says disabling the app is not enough: it must be upgraded to 26.4.303 or later, or removed.

The flaw is being exploited. Administrators reported web shells on their Nextcloud servers from 10 September, and CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on 23 October, with a federal due date of 26 October. The reach is narrower than the score suggests. The app's store listing describes it as being "for local testing and non-production use". Collabora says standalone Collabora Online servers are not affected, and neither are Docker images, RPM/DEB packages or Nextcloud All-in-One. CERT Polska adds that Nextcloud Office installs that use a separate Collabora server are not affected. If you or your suppliers run the built-in app, upgrade or remove it now, then check for web shells.

Technical Information

What Collabora has said (GHSA-g3vx-3m76-fghh, published 14 October 2026):

• Users of Nextcloud with the Built-in CODE Server app "can be vulnerable through proxy.php. A request can cause an operating system command to run as the web server user."
• "The attack only works while the built-in CODE server is not running. So on a container restart, an upgrade, or after a crash."
• "It is not sufficient to disable the app to avoid the problem, it must be upgraded to >= 26.4.303 or removed."
• "Users of EOL Nextcloud <= 29 should upgrade their Nextcloud or remove this app."
• "Standalone Collabora Online servers are not affected."
• Collabora says this is not the same path as an earlier 2025 CVE, and that the fix for that issue does not prevent it.

In a blog post on 15 October, Collabora said the scope "is narrow". It said the app "is not Collabora's recommended installation method and is used by a minority of Nextcloud users", and described it as "focused on home users". Collabora also said "No Collabora Online customers were affected". It added that users of its Docker images, RPM/DEB packages or the Nextcloud All-in-One images are unaffected.

What the app is. The Built-in CODE Server app downloads Collabora Online Development Edition (CODE) and runs it on the Nextcloud server itself. That lets Nextcloud Office edit documents without a separate Collabora server. The Nextcloud app store listing calls it a "Built-in Collabora Online Development Edition (CODE) server for local testing and non-production use", "for personal use or for small teams".

Severity and scoring. Collabora's advisory rates the flaw Critical with a CVSS 4.0 score of 9.2. The CVE record was published by MITRE as the CNA and carries the same 9.2 score and vector. The vector marks the attack as network-reachable, low complexity, needing no privileges or user interaction, with attack requirements present. NVD lists the CVE as "Deferred" and shows only MITRE's score; it has not published its own. So there is no score conflict between sources. CISA's assessment on the CVE record (dated 23 October) records exploitation as "active", automatable as "yes" and technical impact as "total".

What attackers did, as reported by administrators. These details come from administrators' own reports on the app's GitHub issue #354, not from Collabora:

• The first reporter, an administrator who hosts several Nextcloud servers, posted access-log entries from 10 and 11 September. All of that administrator's servers ran version 26.4.302. The requests wrote PHP web shells into the app's folder.
• On one of those servers, the reporter said the attacker used a web shell to search for password-manager files, password databases and cryptocurrency wallet files.
• The reporter wrote that the reviewed requests "did not show explicit commands for archiving, uploading, or exfiltrating files". The reporter added that anything the web server account could read "must be treated as potentially affected".
• Two other administrators reported the same pattern on their own servers. One found the web shell when Nextcloud's integrity check flagged a new PHP file. The other noticed emails about failed sudo attempts.

One national CERT reports a file was taken. On 16 October, Italy's national CSIRT (ACN) published bulletin BL02/261016/CSIRT-ITA. It reports one compromised Nextcloud server in Italy. In that case, ACN says the attacker installed three web shells and took a configuration file containing credentials and application secrets. ACN says it found no evidence of access to users' documents, administrative privileges, further persistence or lateral movement. It describes the activity as consistent with an automated campaign that is still active and run by more than one actor. So the "no file copying" finding above applies to the first reporter's servers only. It does not rule out data theft elsewhere.

Ransomware. CERT Polska's notice of 20 October says the flaw "jest aktywnie wykorzystywana do przeprowadzania ataków ransomware i przejmowania kontroli nad serwerami" (is being actively used to carry out ransomware attacks and take over servers), while CISA's KEV entry lists known ransomware use as "Unknown" (checked 24 Oct, 18:52 Cyprus time (UTC+3)); we have not seen a public ransomware case tied to this CVE.

The fix and the releases since. According to Nextcloud's app store, version 26.4.303 was published on 11 September and needs Nextcloud 30 or later. Its release notes name only the bundled CODE build, with no security note. Version 26.4.402 followed on 24 September. Some administrators have since opened GitHub issues saying 26.4.402 fails to start or to open documents on their setups, and that going back to 26.4.303 fixed it. Collabora published the advisory and the CVE on 14 October, about five weeks after the fix. In its blog post, Collabora said getting a CVE published through GitHub had gone "from around a day to many weeks this year". Version 26.4.502 was published on 23 October. Collabora's advisory names 26.4.303 and later as fixed, so all three releases include the fix.

What is not known. No one has said how many servers were hit. Collabora has not said how many installs use the built-in app. It is also not known whether the activity reported in October is the same campaign as the September attacks.

Timeline (dates as the sources print them):

• 10 September: The earliest attack request in the first administrator's logs on GitHub issue #354.
• 11 September: Version 26.4.303, the fix, is published on the Nextcloud app store. The first administrator opens issue #354 the same day.
• 3 October: A member of the Nextcloud community forum warns users of the built-in app to update, saying the flaw "is already being exploited".
• 14 October: The CVE record (CNA: MITRE) and Collabora's GHSA-g3vx-3m76-fghh are published. Collabora's blog post follows on 15 October.
• 15 to 21 October: National CERTs publish: CERT.LV (15 October), ACN's CSIRT Italia (16 October), Germany's BSI with WID-SEC-2026-4011, rated "kritisch" (19 October), CERT Polska (20 October) and JPCERT/CC in its weekly report (21 October).
• 23 October: CISA adds CVE-2026-110447 to KEV, with a due date of 26 October. Version 26.4.502 is published.
• 24 October: CVE-2026-110447 is still in the KEV catalog (version 2026.10.23), with forensic triage required for US federal agencies and known ransomware use "Unknown" (checked 24 Oct, 18:52 Cyprus time (UTC+3)). We found no advisory on this flaw from the Canadian Centre for Cyber Security, CERT-EU, the UK NCSC or CERT-FR, and no advisory from Nextcloud itself (checked 24 Oct, 18:52 Cyprus time (UTC+3)).

Affected Product Versions

Per Collabora's GHSA-g3vx-3m76-fghh, the CVE record and the Nextcloud app store (checked 24 October 2026).

The fixed releases support Nextcloud 30 up to, but not including, 36, according to the app store.

Workaround and Mitigation

1. Upgrade or remove the app. Update Collabora Online - Built-in CODE Server to 26.4.303 or later, or uninstall it. Disabling it in Nextcloud does not close the flaw, Collabora says. If you do not use it, remove it.
2. Upgrade old Nextcloud. Nextcloud 29 and older cannot install a fixed release. Upgrade Nextcloud to 30 or later, or remove the app.
3. If a newer release breaks, go back to 26.4.303, not to an older one. Some administrators report problems with 26.4.402 on their setups. 26.4.303 is the version Collabora's advisory names as the fix.
4. Check for compromise, even after upgrading. The upgrade does not remove a web shell that is already there. Run Nextcloud's integrity check and look for unexpected PHP files, starting in the app's folder (apps/richdocumentscode). Review web server logs for unusual requests to proxy.php back to at least 10 September. CERT Polska and ACN list what to look for.
5. Treat what the web server account could read as exposed. If you find signs of compromise, follow ACN's advice: isolate the server and keep evidence before cleaning up. Then rotate database passwords, service mailbox passwords, app passwords and application secrets from a trusted system. Check whether those credentials have been used elsewhere.
6. Consider a separate Collabora server for production (Rescana guidance). This matches Collabora's own position: its CODE page says CODE "is perfect for testing, home use or small teams, but not recommended for production environments", and the app store lists the built-in app "for local testing and non-production use".

Indicators of Compromise

These indicators come from administrators' posts on GitHub issue #354 and one Nextcloud community forum post. Neither Collabora nor Nextcloud has published an IOC list, although a Collabora team member on issue #354 advised users to "remove any lingering shx*.php files". The indicators have been defanged.

• IP addresses: 139.28.18[.]122 (the 10 and 11 September attacks, first reporter); 89.38.98[.]50 (a 14 September attempt against an updated server, second administrator)
• Callback domain: webhook[.]site, a legitimate public service the attacker used to receive callbacks. Treat outbound requests to it from a Nextcloud server as suspicious, but do not treat the service itself as malicious.
• Web shell file names: shx*.php and similar names in apps/richdocumentscode/, including shrf4645.php, shxa35d0.php, shx5cf91.php, shxd33ce.php and shxf4645.php (first reporter), and shx13a86.php (second administrator)
• Another file name (community forum report, unconfirmed): Nx_33143.php in apps/richdocumentscode/, flagged by Nextcloud's integrity check and reported by one user on the Nextcloud community forum on 16 October. Neither Collabora nor Nextcloud has tied it to this CVE.
• SHA-256 of one recovered web shell (first reporter): 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562

No source we checked maps this activity to MITRE ATT&CK, and we have not done so.

What we will update

We will update this post if Collabora revises GHSA-g3vx-3m76-fghh or ships another security fix for the app. We will also update it if CISA changes the KEV entry, including its ransomware field, or if NVD publishes its own score. Finally, we will update it if another national CERT, or Nextcloud itself, publishes an advisory or new indicators, or if the number of affected servers is reported.

Sources

Collabora

• Collabora Online, "Unauthenticated OS command injection in the richdocumentscode proxy", GHSA-g3vx-3m76-fghh (14 October 2026): https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh; blog post "Stay Safe: Upgrade Everything Regularly" (15 October 2026): https://www.collaboraonline.com/blog/stay-safe-upgrade-everything-regularly/; CODE edition page: https://www.collaboraonline.com/code/
• Collabora, richdocumentscode releases (26.4.303, 26.4.402, 26.4.502): https://github.com/CollaboraOnline/richdocumentscode/releases; GitHub issue #354, administrators' reports and IOCs (opened 11 September 2026): https://github.com/CollaboraOnline/richdocumentscode/issues/354

Nextcloud

• Nextcloud app store listing for Collabora Online - Built-in CODE Server (checked 24 Oct, 18:52 Cyprus time (UTC+3)): https://apps.nextcloud.com/apps/richdocumentscode; community forum thread "To Collabora Built-in User: Update ASAP" (a community member's post, 3 October 2026): https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516

CISA, CVE and NVD

• CISA, "CISA Adds One Known Exploited Vulnerability to Catalog" (23 October 2026): https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0; KEV catalog, version 2026.10.23 (checked 24 Oct, 18:52 Cyprus time (UTC+3)): https://www.cisa.gov/known-exploited-vulnerabilities-catalog; CVE record (CNA: MITRE; CISA-ADP): https://www.cve.org/CVERecord?id=CVE-2026-110447; NVD (Deferred, checked 24 Oct, 18:52 Cyprus time (UTC+3)): https://nvd.nist.gov/vuln/detail/CVE-2026-110447

National CERTs

• ACN / CSIRT Italia, BL02/261016/CSIRT-ITA (16 October 2026): https://www.acn.gov.it/portale/w/nextcloud-rilevato-sfruttamento-di-una-vulnerabilita-nel-componente-collabora-online-built-in-code-server; BSI / CERT-Bund, WID-SEC-2026-4011 (19 October 2026): https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4011; CERT Polska, 194/2026 (20 October 2026): https://moje.cert.pl/komunikaty/2026/194/krytyczna-podatnosc-w-collabora-online-dla-nextcloud-aktywnie-wykorzystywana-w-atakach/; CERT.LV (15 October 2026): https://www.cert.lv/lv/2026/10/kritiska-ievainojamiba-collabora-online-built-in-code-server; JPCERT/CC Weekly Report 2026-10-21, item 10: https://www.jpcert.or.jp/wr/2026/wr261021.html

Why this matters for your vendors

Many suppliers and MSPs host Nextcloud for file sharing and collaboration, and some may use the built-in CODE app for document editing. A short, friendly check on whether they run it, and whether they have upgraded and looked for web shells, will tell you most of what you need.

Forward this to your TPRM owner (Rescana guidance). Questions for suppliers that host Nextcloud for you or with your data:

• Do you run Nextcloud, and is the Collabora Online - Built-in CODE Server app (richdocumentscode) installed, even if disabled?
• If so, is it on 26.4.303 or later, or has it been removed? On which date?
• Are any of your Nextcloud servers on version 29 or older?
• Have you run Nextcloud's integrity check and reviewed web server logs back to 10 September for signs of compromise?
• If you found anything, which credentials and secrets did you rotate, and was any of our data on that server?

Want a clear view of which suppliers host file-sharing platforms like Nextcloud, and how quickly they patch? Book a demo.