# Nextcloud built-in CODE Server: exploited command injection Canonical: https://www.oktsec.com/radar/collabora-nextcloud-cve-2026-110447 Publisher: Oktsec Language: en Published: 2026-10-24T13:11:44Z Updated: 2026-10-24T13:27:53Z Record reviewed: 2026-10-24T13:11:44Z Latest evidence check: 2026-10-24T13:11:44Z Disclosed: 2026-09-11 Known exploitation affects the Collabora Built-in CODE Server app for Nextcloud before 26.4.303. Upgrade or remove the app; disabling it is insufficient. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Act now - Rationale: CISA lists known exploitation. A request can execute commands as the web server user while a vulnerable built-in CODE server is stopped; disabling the app does not close the path. - Evidence: Exploitation confirmed - Verification: Multiple sources - Fix status: Fix available - Exposure requirement: No login required - Vendor: Collabora - Products: Nextcloud · Collabora Built-in CODE Server - CVEs: CVE-2026-110447 - Vendor severity: CVSS 4.0 9.2 ## Technical overview The vendor advisory describes unauthenticated command injection through proxy.php in Nextcloud’s richdocumentscode app. The vulnerable path requires the built-in CODE server to be stopped, which can happen after a restart, upgrade or crash. Standalone Collabora Online servers are excluded. The vendor identifies 26.4.303 as the fixed app release. Merely disabling the app is insufficient; upgrade or remove it. For end-of-life Nextcloud 29 or older, the vendor advises upgrading Nextcloud or removing the app. The fix for CVE-2025-66208 does not address this separate vulnerability. The public incident thread began September 11; the formal advisory was published October 14 and CISA added the CVE to KEV on October 23. These dates describe reporting and catalog inclusion, not the beginning of every attack. CISA does not confirm ransomware use in the reviewed entry. Oktsec recommends preserving evidence and investigating the host for earlier compromise alongside remediation. Patch status alone cannot establish that files, credentials or documents remained untouched. ## Recommended response Upgrade or remove the vulnerable app and investigate possible access to the Nextcloud host. Relevant to: Organizations running the richdocumentscode app inside Nextcloud. ## CVE attribution - CVE-2026-110447: Collabora — Nextcloud · Collabora Built-in CODE Server. [Source](https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh) ## Exploit demonstration Status: Public demonstration not established CVEs: CVE-2026-110447 Checked: 2026-10-24T13:11:44Z The reviewed advisories establish exploitation in the wild, but do not document a separately validated research exploit demonstration. This does not mean exploit code is unavailable. [Supporting source](https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh) [Supporting source](https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/110xxx/CVE-2026-110447.json) ## Affected systems and fixes ### Nextcloud app: richdocumentscode Affected: Before 26.4.303; the attack path is reachable while the built-in CODE server is stopped Fixed release / action: 26.4.303 Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.10.23 Checked: 2026-10-24T13:11:44.767Z ### [CVE-2026-110447](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110447) - Added: 2026-10-23 - Ransomware use: Not confirmed by CISA - Federal due date: 2026-10-26 - Federal forensic triage: Yes Action specified by CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-10-24T13:12:50.979Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast - [CVE-2026-110447](https://api.first.org/data/v1/epss?cve=CVE-2026-110447): 1.23% probability of observed exploitation in the next 30 days; percentile 68.62%; score date 2026-10-23. EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-10-24T13:12:50.979Z. ## Response checklist 1. **Identify the built-in deployment** — Inventory Nextcloud instances with the richdocumentscode app and record its installed version. This advisory excludes standalone Collabora Online servers; do not infer exposure from the Collabora name alone. 2. **Upgrade or remove the app** — Update richdocumentscode to 26.4.303 or a later fixed release, or remove it. Disabling it is insufficient. For end-of-life Nextcloud 29 or older, follow the vendor guidance to upgrade Nextcloud or remove the app; verify the deployed result. 3. **Investigate earlier access** — Preserve available web, application and host evidence. Investigate unexpected PHP files, processes and access under the web server account. If compromise is suspected, isolate the host and follow incident response procedures; a successful upgrade does not remove prior attacker access. ## Relevance to AI environments If agents use this Nextcloud instance, include their credentials and accessible documents in the exposure review. No agent-specific exploit is established. ## Sources - [Vendor advisory: unauthenticated command injection in richdocumentscode](https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh) — Collabora; Vendor notice; checked 2026-10-24T13:11:44Z - [CVE record and CISA exploitation assessment](https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/110xxx/CVE-2026-110447.json) — CVE Program · MITRE / CISA; Government advisory; checked 2026-10-24T13:11:44Z - [Initial incident report and maintainer response](https://github.com/CollaboraOnline/richdocumentscode/issues/354) — Collabora repository · reporter and maintainers; Research report; checked 2026-10-24T13:11:44Z ## Editorial record - 2026-10-24T13:11:44Z: Initial Radar publication after reviewing the vendor advisory, original incident thread, CVE record and October 23 CISA KEV inclusion. Exploitation is confirmed; the app-specific deployment condition and fixed version are explicit. - 2026-10-24T13:27:53Z: Added explicit product identity for each CVE. ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.