HomeOctober 2026 patch cycleNextcloud's built-in Collabora app: exploited for six weeks, CVE'd for ten days
Call: Patch nowCategory: EnterpriseCategory: Homelabfrom 2026-10
Nextcloud's built-in Collabora app: exploited for six weeks, CVE'd for ten days
Part of October 2026 patch cycle
- Vendor
- Nextcloud
- Products
- Collabora Online - Built-in CODE Server (richdocumentscode) before 26.4.303
- Published
- Status
- Open
Call: Patch now. CVE-2026-110447 is unauthenticated command injection in the optional “Collabora Online - Built-in CODE Server” Nextcloud app (richdocumentscode). Admins reported attacks going back to Sept 10, and CISA added it to KEV on Oct 23.
Fixed in: richdocumentscode 26.4.303, released Sept 11. The advisory and CVE didn’t appear until Oct 14, so if your scanner stayed quiet in September, that’s why.
How it works: A request to the app’s proxy.php injects OS commands, but only while the bundled CODE server is stopped. Attackers have been dropping PHP web shells and hunting for password databases, password-manager files and crypto wallets.
Who’s hit: Self-hosted Nextcloud with the built-in CODE app. Collabora says standalone Collabora Online, Docker and RPM/DEB installs, and Nextcloud All-in-One aren’t affected.
Do: Update to 26.4.303 or later, or remove the app. Disabling it isn’t enough. Then look in apps/richdocumentscode for PHP files you didn’t put there, and check proxy.php requests back to Sept 10. On Nextcloud 29 or older, upgrade Nextcloud or remove the app.
Sources: BleepingComputer (opens in a new tab), GitHub advisory (opens in a new tab), The Hacker News (opens in a new tab).
Sources
- https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/ (opens in a new tab)
- https://github.com/advisories/GHSA-f97p-r72q-64h2 (opens in a new tab)
- https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html (opens in a new tab)
- https://ismalicious.com/cve/kev/2026-10 (opens in a new tab)