---
title: Nextcloud "Collabora Online - Built-in CODE Server" CVE-2026-110447: unauthenticated RCE exploited since September | ctxsec
url: https://ctxsec.com/items/nextcloud-richdocumentscode-cve-2026-110447
description: ""
status: "exploited (vendor advisory)"
published: 2026-10-14
---

> 

[← Cybersecurity News](/news) · [markdown](/items/nextcloud-richdocumentscode-cve-2026-110447.md)

exploited (vendor advisory)

2026-10-14

### Nextcloud "Collabora Online - Built-in CODE Server" CVE-2026-110447: unauthenticated RCE exploited since September

Collabora's GitHub advisory GHSA-g3vx-3m76-fghh (critical, CVSS 4.0 9.2) covers an unauthenticated OS command injection in `proxy.php` of the Nextcloud app `richdocumentscode` before 26.4.303. A request can run commands as the web-server user, but only while the bundled CODE server is not running (for example after a container restart, an upgrade or a crash). The CVE record says it was exploited in the wild in September and October 2026, and Nextcloud forum users reported finding webshells as early as Oct 3. Standalone Collabora Online servers are not affected, and this is a different path from CVE-2025-66208. **Fix:** upgrade `richdocumentscode` to 26.4.303+ or remove it. Collabora says disabling the app is not enough. Users on EOL Nextcloud 29 or older should upgrade Nextcloud or remove the app. Not in CISA KEV as of catalog 2026.10.13. Patching does not remove backdoors, so also check `apps/richdocumentscode/` for unexpected PHP files (secondary reports cite `shx*.php` / `shrf*.php`) and rotate secrets the web user can read. **Update Oct 15:** Administrator reports cited by BleepingComputer date attacks back to Sept 10, the day after the fix was committed and a day before 26.4.303 shipped (Sept 11). The planted PHP webshells were used to search for password databases, password-manager files and cryptocurrency wallets. Some users also claim ransomware operators are using the flaw, but BleepingComputer couldn't confirm that. Collabora blames the month-long gap before the advisory and CVE mainly on GitHub CVE-processing backlogs. Still not in CISA KEV (catalog 2026.10.15).

Sources: [Collabora advisory GHSA-g3vx-3m76-fghh](https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh) · [CVE-2026-110447 (CVE.org)](https://www.cve.org/CVERecord?id=CVE-2026-110447) · [Nextcloud forum: update ASAP](https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516) · [richdocumentscode issue #354](https://github.com/CollaboraOnline/richdocumentscode/issues/354) · [BleepingComputer (Oct 15)](https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/)