Nextcloud and Collabora: flaw CVE-2026-110447 is already being exploited, what to check
A critical vulnerability in the optional Nextcloud app “Collabora Online - Built-in CODE Server” lets attackers run commands on the server without logging in, and it has been exploited since at least 10 September 2026. Who is affected, which version to install and what to check if your server was exposed.
Many SMEs use Nextcloud as their company cloud for files, calendars and shared documents, often installed on their own server or a VPS. If you enabled in-browser document editing with the optional app “Collabora Online - Built-in CODE Server” (technical name richdocumentscode), check the installed version now: a critical vulnerability in this app, CVE-2026-110447, allows commands to be run on the server without authentication, and it has already been exploited.
On 23 October 2026, the US agency CISA added it to its catalogue of actively exploited vulnerabilities. Below you will find the verified facts, who is affected and what to do.
What happened
According to Collabora's security advisory, published on 14 October 2026, the app's proxy.php script can be made to run an operating system command with the rights of the web server user. No credentials and no user interaction are needed. The CVSS 4.0 score is 9.2 out of 10, critical.
There is one condition: the attack only works while the built-in CODE server is not running, for example while a container restarts, during an upgrade or after a crash. The window is limited, but it reopens with every restart.
The fix has been available since 11 September 2026 in version 26.4.303 of the app, but without a security notice. The CVE identifier only followed on 14 October. Collabora explains on its blog that the delay was mainly due to CVE processing times at GitHub, slowed down by the high volume of AI-generated security reports.
The threat situation
The vulnerability record in the NVD states that the flaw was exploited in September and October 2026. According to administrator reports compiled by BleepingComputer and The Hacker News, the first logged attack dates from 10 September 2026, the day after the fix was committed to the source code. The attackers dropped small PHP files that act as a back door (web shells) and used them to search for password databases and cryptocurrency wallets. How many servers were hit is not known.
On 3 October, a user on the official Nextcloud forum had already urged others to update, because the flaw was being exploited and no public advisory existed yet.
Who is affected
- Affected: anyone who has installed the “Collabora Online - Built-in CODE Server” app (
richdocumentscode) in a version before 26.4.303. - Not affected, according to Collabora: standalone Collabora Online servers, Docker images, RPM/DEB packages and Nextcloud All-in-One, as well as setups that use a hosted Collabora service.
Collabora points out that the built-in app is aimed mainly at home users, is not its recommended installation method and is used by a minority of Nextcloud users. In practice, however, it also turns up in small business installations, precisely because it is the quickest way to edit Office documents in Nextcloud.
One important point: disabling the app is not enough. The vulnerable script stays in the app folder and can be called directly. The app must be updated to version 26.4.303 or later, or removed.
What to do now
1. Check your installation
In the Nextcloud administration, under Apps, check whether “Collabora Online - Built-in CODE Server” is present and which version it is. If your Nextcloud is run by a provider, ask them in writing whether the app is installed and up to date.
2. Update or remove
Update the app to version 26.4.303 or later. The fixed versions require Nextcloud 30 or later: in the Nextcloud app store, at the time of writing, version 26.4.502 is available for Nextcloud 30-35, while Nextcloud 29 and older are still offered a vulnerable version. Nextcloud 29 and older no longer receive updates: in that case, upgrade Nextcloud or remove the app. If you do not use in-browser document editing, the simplest solution is to uninstall it.
3. Check whether the server was compromised
The update closes the flaw, but it does not undo an intrusion that has already happened. If the vulnerable app was installed and the server is reachable from the internet:
- Run the Nextcloud integrity check (Administration settings, Overview): it flags PHP files that are not part of the official package. In one of the cases reported on the forum, this check is what uncovered the web shell.
- Look for unexpected PHP files in the app folder and the rest of the installation.
- Review the web server access logs at least back to 10 September 2026, especially requests to the app's
proxy.phpscript. - If you find signs of compromise, treat everything the web server user could read as exposed: change the database password and the other credentials in the Nextcloud configuration, including mail credentials, and consider restoring from a clean backup.
4. Reduce exposure in future
For business use, a separate Collabora server is preferable to the built-in app, and access to Nextcloud should be restricted where possible via VPN or multi-factor authentication (see the NCSC's five levels of secure logins). The case also confirms a point raised by this week's PHP vulnerabilities: updates should be installed regularly, even when they do not come with a security notice.
Reporting obligations in Switzerland
If a server holding customer or staff data has been compromised, legal aspects come into play as well:
- Data protection (revFADP): a data security breach that is likely to result in a high risk for the people concerned must be reported as soon as possible to the Federal Data Protection and Information Commissioner (FDPIC), under Art. 24 FADP. The FDPIC provides an online form and guidelines.
- Critical infrastructure: since 1 April 2025, operators of critical infrastructure, including cantonal and municipal administrations, must report cyberattacks to the NCSC within 24 hours of discovery.
- For all other companies, reporting to the NCSC is voluntary but useful: the online form also gives an initial assessment of the case.
The “SME Cybersecurity 2026” study showed that organisational preparation, meaning knowing who does what in an incident, is the weak spot of many SMEs.
Frequently asked questions
I use Nextcloud: am I automatically at risk?
No. The flaw only concerns the optional “Collabora Online - Built-in CODE Server” app. Nextcloud itself and separately installed Collabora servers are not affected.
I disabled the app: is that enough?
No. According to Collabora, disabling it is not sufficient: the app must be updated to version 26.4.303 or later, or removed.
I updated in September: is there anything else to do?
The first documented attack dates from 10 September, before the fixed version was released. If the vulnerable app was installed around that time, it is worth running the integrity check and looking at the logs.
My Nextcloud is run by a provider: what should I do?
Ask for written confirmation that the built-in app is either not installed or up to date, and whether checks for possible compromise have been carried out.
Our approach
ElaraTeq Sagl runs websites and applications for SMEs and public bodies in Ticino with hosting in Switzerland. We can check your Nextcloud installation, update or remove the vulnerable app and verify the integrity of the server. For ongoing maintenance there is the service described in Orbit; for a check, get in touch.
Sources
- Collabora, security advisory “Unauthenticated OS command injection in the richdocumentscode proxy”, 14 October 2026: GHSA-g3vx-3m76-fghh
- Collabora, “Stay Safe: Upgrade Everything Regularly”, 15 October 2026: collaboraonline.com
- NIST NVD, CVE-2026-110447; CVE Program, CVE-2026-110447
- CISA, “CISA Adds One Known Exploited Vulnerability to Catalog”, 23 October 2026: cisa.gov
- Nextcloud Community, “To Collabora Built-in User: Update ASAP”, 3 October 2026: help.nextcloud.com
- Nextcloud App Store, Collabora Online - Built-in CODE Server (available versions, accessed 24 October 2026)
- BleepingComputer, 15 October 2026: Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers; The Hacker News, 14 October 2026: Hackers Backdoor Nextcloud Servers
- FDPIC, reporting data security breaches; NCSC, reporting obligation for cyberattacks on critical infrastructure
