Nextcloud Collabora CVE-2026-110447: update or remove the app

If your team edits documents in a self-hosted Nextcloud, check one app today. On October 23, CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog. The bug sits in Collabora Online's Built-in CODE Server, the richdocumentscode app that turns Nextcloud into a Google Docs replacement with one click. Attackers have used this Nextcloud Collabora vulnerability to drop web shells. The fix has been out since September. Many servers still do not have it.

What actually happened

Collabora's security advisory, published October 14, rates the flaw Critical, CVSS v4 9.2. The proxy.php script in the app passed request text into a shell command. An unauthenticated request could run commands as the web server user.

There is a catch that made it easy to miss. The attack only works while the bundled CODE server is not running: during a container restart, an upgrade, or a crash. Every Nextcloud admin has those windows.

Key facts from the advisory:

• Affected: richdocumentscode below 26.4.303. Standalone Collabora Online servers are not affected.
• Disabling the app does not fix it. You must upgrade or remove it.
• Nextcloud 29 and older are end-of-life and cannot take the fix. Upgrade Nextcloud or remove the app.
• This is a different path from CVE-2025-66208. That old fix does not cover it.

CISA's alert confirms the KEV listing. The Hacker News reports, based on a GitHub issue opened by affected admins, that the first logged attack was September 10, one day before the patched release. Attackers planted one-line PHP web shells in the app folder and, on at least one server, searched for credential stores and crypto wallets. The total number of hit servers is not public.

Why the Nextcloud Collabora flaw matters for your business

Self-hosted means self-patched. Small teams pick Nextcloud to own their files and drop a SaaS bill. That is a good call. But nobody pushes app updates to you. If the person who set it up left, this app has probably sat untouched since install.

Patched is not clean. The attacks started before the fix shipped. If you updated in late September, you could still have a web shell from September 10. Look for shx*.php files in apps/richdocumentscode/ and check access logs back to September 10 for proxy.php requests with $( or base64 -d.

Your file server holds the keys. A Nextcloud box often stores contracts, payroll exports, and password files. Treat anything the web server account could read as exposed until you prove otherwise.

Sources: Collabora advisory GHSA-g3vx-3m76-fghh, CISA KEV alert, October 23, 2026, The Hacker News.