Attackers backdoor Nextcloud servers through the Collabora Built-in CODE Server app (CVE-2026-110447)

An unauthenticated OS command injection in proxy.php of Collabora Online - Built-in CODE Server (richdocumentscode), an optional Nextcloud app, lets attackers run commands on the Nextcloud server whenever the app's local CODE document server isn't running, for example during a restart, an upgrade or after a crash. It was exploited in the wild in September and October 2026 to plant web shells, with the first attack reported on GitHub on Sep 10. Collabora fixed it in richdocumentscode 26.4.303 on Sep 11 and published CVE-2026-110447 (CVSS 4.0 9.2) on Oct 14; it is a different bug from the 2025 proxy RCE CVE-2025-66208. Turning the app off is not enough: update it or remove it. Standalone Collabora Online servers, Docker or distro packages, hosted Collabora, and Nextcloud Office (richdocuments) without the built-in app are not affected. Admins who ran a vulnerable version should also hunt for unexpected PHP files.

Why this severity: Unauthenticated RCE exploited in the wild; CVSS 4.0 9.2; only when the local CODE server isn't running

Started

Sep 10, 2026

CVE

CVE-2026-110447

• PHP
• #Nextcloud
• #Collabora
• RCE
• #Command Injection
• #Web Shell
• #Exploited