A severe vulnerability in Collabora Online’s built-in CODE Server app — used within Nextcloud installations — is being actively exploited to plant web shells and allow remote attackers to issue operating system commands without authentication. Tracked as CVE-2026-110447, the issue carries a CVSS v4 rating of 9.2, marking it one of the most serious threats seen recently.
The flaw, affecting versions of the richdocumentscode app prior to 26.4.303, allows attackers to execute OS-level commands by sending specially crafted requests to the proxy.php component. Because this attack vector relies solely on server behavior rather than user login or interaction, it enables command injection classified under CWE-78. All that’s required is for the built-in CODE server to be inactive when the malicious request is processed — for example, during container restarts, upgrades, or after crashes. That creates a dangerous window even in systems being actively maintained.
Signs of Real-World Exploitation
Systems have already been compromised. In September and October 2026, administrators reported finding web shells present on affected servers. The advisory draws a clear distinction that standalone Collabora Online servers are not vulnerable — only installations where Collabora’s CODE is integrated via the richdocumentscode app in Nextcloud are at risk. Fixing other, older vulnerabilities won’t close this one.
What Admins Need to Do Now
Urgent action is required. Administrators should update the richdocumentscode app to version 26.4.303 or higher, or remove it entirely. Merely disabling the app is insufficient to block exploitation. For Nextcloud instances running end-of-life versions—version 29 or earlier—upgrading Nextcloud or removing the affected app is essential. Post-patch, it’s also vital to manually inspect servers for unexpected PHP files or indicators of compromise, since patching only prevents future exploitation, and won’t cleanse existing backdoors.
This vulnerability is distinct from earlier Nextcloud or Collabora flaws — it is not mitigated by fixes for CVE-2025-66208, nor related to previous URL-handling bugs in the Nextcloud desktop client. It is a server-side proxy issue unique to the richdocumentscode integration. It demands focused remediation efforts from administrators.
WHY THIS MATTERS: CODE integration is widely used by organizations that need collaborative document editing on private Nextcloud servers. A flaw that permits remote command execution without login undermines trust in the system’s security model and exposes data, workloads, and infrastructure to risk. For affected users, updating and scanning for signs of intrusion should be treated as high priority. Going forward, monitoring advisories, isolating services, and reducing reliance on large attack surfaces are steps that teams must take to limit such exposure.
