# Attackers backdoor Nextcloud servers through the Collabora Built-in CODE Server app (CVE-2026-110447) · pwn.watch > An unauthenticated OS command injection in proxy.php of Collabora Online - Built-in CODE Server (richdocumentscode), an optional Nextcloud app, lets attackers run commands on the Nextcloud server whenever the app's local CODE document server isn't running, for example during a restart, an upgrade or after a crash. It was exploited in the wild in September and October 2026 to plant web shells, with the first attack reported on GitHub on Sep 10. Collabora fixed it in richdocumentscode 26.4.303 on Sep 11 and published CVE-2026-110447 (CVSS 4.0 9.2) on Oct 14; it is a different bug from the 2025 proxy RCE CVE-2025-66208. Turning the app off is not enough: update it or remove it. Standalone Collabora Online servers, Docker or distro packages, hosted Collabora, and Nextcloud Office (richdocuments) without the built-in app are not affected. Admins who ran a vulnerable version should also hunt for unexpected PHP files. Page: https://pwn.watch/i/nextcloud-collabora-built-in-code-server-cve-2026-110447 · generated 2026-10-23T22:18:51.766Z ## Status - Severity: critical · status: live · patch: patched - Product: Collabora Online - Built-in CODE Server (richdocumentscode) for Nextcloud - Started: 2026-09-10 - CVEs: CVE-2026-110447 - Affected: richdocumentscode (Collabora Online - Built-in CODE Server) before 26.4.303 - Fixed in: richdocumentscode 26.4.303 or later (latest release 26.4.502), or uninstall the app ## Follow this incident - RSS (one item per update): https://pwn.watch/i/nextcloud-collabora-built-in-code-server-cve-2026-110447/feed.xml - JSON Feed: https://pwn.watch/i/nextcloud-collabora-built-in-code-server-cve-2026-110447/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/nextcloud-collabora-built-in-code-server-cve-2026-110447.json - This file: https://pwn.watch/i/nextcloud-collabora-built-in-code-server-cve-2026-110447/llms.txt ## Updates (newest first) - 2026-10-14: CVE-2026-110447 is published, noting exploitation in the wild in September and October 2026. (https://nvd.nist.gov/vuln/detail/CVE-2026-110447) - 2026-10-03: A Nextcloud forum post warns built-in CODE users to update ASAP after web shells were found on servers. (https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516) - 2026-09-11: A hosting provider reports successful attacks via richdocumentscode proxy.php on GitHub, the first logged on Sep 10. (https://github.com/CollaboraOnline/richdocumentscode/issues/354) - 2026-09-11: Collabora releases richdocumentscode 26.4.303 with the fix. (https://github.com/CollaboraOnline/richdocumentscode/releases/tag/26.4.303) ## Fix brief # Security brief: Attackers backdoor Nextcloud servers through the Collabora Built-in CODE Server app (CVE-2026-110447) Source: https://pwn.watch/i/nextcloud-collabora-built-in-code-server-cve-2026-110447 · status: live · severity: critical · updated Oct 23, 2026, 21:26 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is An unauthenticated OS command injection in proxy.php of Collabora Online - Built-in CODE Server (richdocumentscode), an optional Nextcloud app, lets attackers run commands on the Nextcloud server whenever the app's local CODE document server isn't running, for example during a restart, an upgrade or after a crash. It was exploited in the wild in September and October 2026 to plant web shells, with the first attack reported on GitHub on Sep 10. Collabora fixed it in richdocumentscode 26.4.303 on Sep 11 and published CVE-2026-110447 (CVSS 4.0 9.2) on Oct 14; it is a different bug from the 2025 proxy RCE CVE-2025-66208. Turning the app off is not enough: update it or remove it. Standalone Collabora Online servers, Docker or distro packages, hosted Collabora, and Nextcloud Office (richdocuments) without the built-in app are not affected. Admins who ran a vulnerable version should also hunt for unexpected PHP files. Severity detail: Unauthenticated RCE exploited in the wild; CVSS 4.0 9.2; only when the local CODE server isn't running - Product: Collabora Online - Built-in CODE Server (richdocumentscode) for Nextcloud - CVE / advisory ids: CVE-2026-110447 ## Affected versions - richdocumentscode (Collabora Online - Built-in CODE Server) before 26.4.303 ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - richdocumentscode 26.4.303 or later (latest release 26.4.502), or uninstall the app After upgrading, re-run the checks above and redeploy/restart the affected services. ## Latest updates - Oct 14, 2026: CVE-2026-110447 is published, noting exploitation in the wild in September and October 2026. - Oct 3, 2026: A Nextcloud forum post warns built-in CODE users to update ASAP after web shells were found on servers. - Sep 11, 2026: A hosting provider reports successful attacks via richdocumentscode proxy.php on GitHub, the first logged on Sep 10. - Sep 11, 2026: Collabora releases richdocumentscode 26.4.303 with the fix. ## Advisories - [NVD: CVE-2026-110447](https://nvd.nist.gov/vuln/detail/CVE-2026-110447) (NVD) - [GHSA-g3vx-3m76-fghh](https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh) (Collabora) - [GHSA-f97p-r72q-64h2](https://github.com/advisories/GHSA-f97p-r72q-64h2) (GitHub Advisory Database) ## Write-ups & news - [Security issue - Hack (richdocumentscode issue #354)](https://github.com/CollaboraOnline/richdocumentscode/issues/354) - [To Collabora Built-in User: Update ASAP](https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516) - [Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora's Built-in CODE App](https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html) - [Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers](https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/) --- Machine-readable: https://pwn.watch/i/nextcloud-collabora-built-in-code-server-cve-2026-110447.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.