CVE-2026-110447 in Nextcloud's built-in Collabora CODE server is on CISA's KEV list. Fixed in richdocumentscode 26.4.303. No workaround. Here is what to do.
If you edit documents in Nextcloud with Collabora, you are probably using the built-in CODE server. It ships as the richdocumentscode app, and it has a remote code execution (RCE) flaw tracked as CVE-2026-110447. CISA lists it in its Known Exploited Vulnerabilities (KEV) catalog, so attackers have used it in real attacks.
Short answer: Nextcloud’s built-in Collabora CODE server (richdocumentscode) before 26.4.303 lets an unauthenticated attacker run operating system commands while the CODE server is not running (CVE-2026-110447, CVSS 4.0 score 9.2). Standalone Collabora Online servers are not affected. Update the app to 26.4.303 or later. There is no workaround: disabling the app is not enough, so you have to update it or remove it.
What happened?
The flaw is an OS command injection in the proxy component of the richdocumentscode app. The weakness type is CWE-78. When user-supplied data reaches an operating system command without proper escaping, an attacker can run their own commands.
According to NVD and the vendor advisory, the flaw is only triggered while the CODE server is not running. That happens after the app restarts, is updated, or crashes. A server that works fine today is not safe for good: the next restart can open the window.
NVD published the record on 14 October 2026. CISA added the flaw to KEV on 23 October 2026. The NVD description says it was exploited in the wild in September and October 2026, and the KEV listing confirms exploitation. The vendor advisory does not mention exploitation. The KEV entry lists the ransomware campaign use as “Unknown”.
The flaw is old by a few weeks: 23 days have passed since NVD published it. It was confirmed as used in attacks only recently, so it is still a high priority.
NVD and the vendor both state that this is a different vulnerability from CVE-2025-66208. Fixing that earlier flaw does not fix this one.
Who is affected?
| Feature | Details |
|---|---|
| CVE ID | CVE-2026-110447 |
| Product | Collabora Online – Built-in CODE Server (richdocumentscode), a Nextcloud app |
| Affected versions | All versions before 26.4.303 (NVD: “before 26.4.303”) |
| Fixed version | 26.4.303. The issue #354 thread also mentions 26.4.502, a later release that includes a change to stop coolwsd when the app is disabled. |
| Nextcloud requirement | The new app version requires at least Nextcloud 30. For Nextcloud 29 and older, the vendor advises upgrading Nextcloud or removing the app. |
| CVSS score | NVD primary score is 9.8 with CVSS 3.1; the CVSS 4.0 score is 9.2 |
| Severity | Critical |
| Weakness type (CWE) | CWE-78: OS command injection |
| NVD published | 14 October 2026 |
| Added to CISA KEV | 23 October 2026 |
| CISA due date | 26 October 2026 (now passed) |
| Standalone Collabora | Not affected (including Docker and Linux package installs) |
| Ransomware use | Unknown (per KEV) |
CISA’s due date has passed. Do not leave the update for the next maintenance window; plan it today.
What should you do?
- Check your version. In the Nextcloud installation directory, run this as the web server user:
php occ app:list | grep richdocumentscode. If the version is below 26.4.303, you are affected. If Nextcloud runs in Docker, run the command inside the Nextcloud container. - Check your Nextcloud version. The new app version requires at least Nextcloud 30. If you run Nextcloud 29 or older, upgrade Nextcloud first. If you cannot upgrade, remove the app.
- Update the app. The sources do not describe the update method in detail. Follow the app update steps in the Nextcloud administration documentation. After the update, run the command from step 1 again to confirm the version.
- Do not look for a workaround. Neither the vendor nor the issue thread lists one, and disabling the app is not enough. If you cannot update, remove the app. Do it in a maintenance window, and check whether your Nextcloud is reachable from the internet in the meantime.
- If you suspect a compromise. The flaw can be exploited while the CODE server is not running, so check again after updating. In issue #354, the maintainers suggest removing leftover
shx*.phpfiles from the server. CISA also points to forensic triage requirements for this KEV entry. If you see an unknown file, an unexpected admin account, or unusual outbound connections, isolate the server, keep the logs, and get help from a security specialist.
Frequently asked questions
Does this affect me?
Yes, if the richdocumentscode app is installed in Nextcloud and its version is below 26.4.303. If you use standalone Collabora Online, including Docker or Linux package installs, you are not affected.
The CVSS score is critical. Why is it so urgent?
The CVSS score describes the technical severity. The urgency comes from the KEV listing: the flaw is on CISA’s actively-exploited list, and CISA’s due date has passed. Read the score together with that information.
What should I do if I cannot update right away?
The sources list no workaround, and disabling the app is not enough. If you cannot update, remove the app. If you run Nextcloud 29 or older, you need to upgrade Nextcloud first, and if that is not possible, remove the app. Until then, check whether your Nextcloud is reachable from the internet.
Sources
- NVD record: https://nvd.nist.gov/vuln/detail/CVE-2026-110447
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Vendor advisory (GHSA-g3vx-3m76-fghh): https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh
- richdocumentscode issue #354: https://github.com/CollaboraOnline/richdocumentscode/issues/354
- Nextcloud forum notice: https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516
This article was prepared on 6 November 2026 based on CISA and NVD records; it will be updated if new information appears. For server and application updates and ongoing security maintenance, you can reach me through the quote form.