Security notice

Run your own Nextcloud with the built-in Collabora app? Attackers are using this flaw. Update today.

What happened

Nextcloud is software for storing and sharing files, calendars and documents that many businesses run on their own server instead of using a service such as Google Drive or Dropbox. To edit office documents in the browser, Nextcloud can connect to Collabora Online. The "Built-in CODE Server" app is a shortcut for setups without a separate Collabora server: it downloads and starts a copy of Collabora Online inside Nextcloud itself. Only servers with that app installed are at risk. (Collabora, Nextcloud App Store)

• The flaw. Collabora says a request to the app's proxy.php file can make the server run an operating system command as the web server user, the account Nextcloud itself runs as. Collabora's advisory calls it an unauthenticated command injection, so no Nextcloud account is needed. (Collabora)
• When it works. Collabora says the attack only works while the built-in CODE server is not running: "on a container restart, an upgrade, or after a crash." (Collabora)
• How bad. Collabora rates it critical, 9.2 out of 10 on the CVSS 4.0 scale, which describes an attack over the network that needs no login and no user action, but does need a condition to be in place first, here the CODE server not running. (Collabora, NVD)
• Being exploited. The official CVE record says the flaw was "exploited in the wild in September and October 2026." On October 23, 2026, CISA added it to its Known Exploited Vulnerabilities catalog, "based on evidence of active exploitation," gave US federal agencies until October 26 to act, and marked it for forensic triage, meaning agencies are expected to check whether attackers got in before they patched. (NVD, CISA alert, CISA KEV)
• What forum users reported. On October 3, a member of the Nextcloud community forum warned users of the app to update, writing that "There are users who have found WebShells on their Nextcloud server." A web shell is a small file an attacker leaves behind to keep control of a server. On October 16, another forum user wrote that Nextcloud's integrity check had flagged an extra PHP file in the app's folder, and that it contained a backdoor. These are reports from forum users. Nextcloud and Collabora have not said how many servers were affected. (Nextcloud forum)
• The fix came before the warning. The fixed app version, 26.4.303, was released on September 11, 2026. Collabora published its security advisory on October 14. A server that has updated the app since September 11 already has the fix, but could have been reached before that. (Collabora release, Collabora)

Who should worry

This is not a problem with your website or online store, and your site visitors are not at risk from it. It is about the server where your business files may live. Most small businesses that run their own Nextcloud have an IT provider or a technical person looking after it.

Ask about this if any of these are true:

• Your business, or an IT provider for you, runs its own Nextcloud server and you can edit Word, Excel or PowerPoint style files in the browser there.
• The "Collabora Online - Built-in CODE Server" app is installed on that Nextcloud, whether it is turned on or off.
• Your Nextcloud is on version 29 or older.
• You are not sure how your Nextcloud's document editing is set up.

Collabora says standalone Collabora Online servers are not affected. The October 3 forum post also lists as not affected: Nextcloud servers with only the regular "Nextcloud Office" connector app (richdocuments) and not the built-in server app, Collabora run with Docker or from a Linux distribution package, and hosted Collabora services. That list is the forum member's, not Collabora's, so if in doubt, check whether the built-in server app is installed. (Collabora, Nextcloud forum)

If someone else hosts your Nextcloud for you, ask them whether their servers use the built-in CODE server app and whether it is on 26.4.303 or later.

What to do now

Do these today.

1. Ask the question. Send the message below to your IT provider, host or IT person. You need a clear yes or no: is the built-in CODE server app installed on our Nextcloud, and is it on 26.4.303 or later?
2. Update the app to 26.4.303 or later, or remove it. Collabora says turning the app off is not enough. It must be updated or removed. (Collabora)
3. On Nextcloud 29 or older, there is no fixed app for you. Those Nextcloud versions are end of life. Collabora says to upgrade Nextcloud or remove the app. The Nextcloud App Store shows the newest app release for Nextcloud 29 and older is 26.4.104, which is before the fix. (Collabora, Nextcloud App Store)
4. Check whether anyone got in. Updating closes the hole, but it does not show whether someone used it first. CISA expects federal agencies to check for a break in on this one. Ask whoever runs your server to follow the steps below and tell you what they find. If they find anything unexpected, treat the server as broken into and get experienced help. (CISA KEV)
5. If the answer is "I don't know", that is not a no. Ask them to check.

What to send your IT provider, host or IT person

CVE-2026-110447 (Collabora advisory GHSA-g3vx-3m76-fghh, critical, CVSS 4.0 score 9.2) is an unauthenticated OS command injection through proxy.php in the Nextcloud app "Collabora Online - Built-in CODE Server" (richdocumentscode). It runs commands as the web server user while the built-in CODE server is not running, for example after a restart, upgrade or crash. CISA added it to the Known Exploited Vulnerabilities catalog on October 23, 2026, with forensic triage flagged. Please confirm whether richdocumentscode is installed on our Nextcloud, enabled or not. If it is, update it today to 26.4.303 or later, or remove it; Collabora says disabling it is not enough. If our Nextcloud is on version 29 or older, please upgrade Nextcloud or remove the app. Please also run Nextcloud's integrity check, look for unexpected PHP files in apps/richdocumentscode, review web server logs for unusual requests to that app's proxy.php since early September, and tell us what you find. Sources: Collabora advisory, CISA KEV.

Technical steps

Step 1. Check whether the app is installed

In Nextcloud, open Apps and look for "Collabora Online - Built-in CODE Server" under your apps, including disabled ones. On the server, the Nextcloud command line tool shows it too:

php occ app:list

Run it from the Nextcloud folder as the web server user. Look for richdocumentscode and its version. Affected: every version before 26.4.303. (Collabora)

Step 2. Update or remove it

php occ app:update richdocumentscode

or, if you do not need it:

php occ app:remove richdocumentscode

Disabling the app is not enough, Collabora says. On Nextcloud 29 or older, upgrade Nextcloud first or remove the app. Collabora also says this is a different path from the earlier CVE-2025-66208, and the fix for that one does not prevent this one. (Collabora)

Step 3. Look for files that should not be there

php occ integrity:check-app richdocumentscode

An "EXTRA_FILE" result means a file is in the app's folder that the official release does not include. That is how the October 16 forum user found a backdoor file. Also look for unexpected PHP files in apps/richdocumentscode by hand. A clean result does not prove the server is clean, because an attacker who ran commands as the web server user could have changed other things too. (Nextcloud forum)

Step 4. Review the logs

The CVE record says exploitation began in September 2026, so review web server access logs back to at least early September for unusual requests to apps/richdocumentscode/proxy.php. If you suspect a break in, keep copies of the logs and any suspicious files before you change anything, and get experienced incident response help. (NVD)

Common questions

Sources

• Collabora: Unauthenticated OS command injection in the richdocumentscode proxy (GHSA-g3vx-3m76-fghh), October 14, 2026
• Collabora: Collabora Online - Built-in CODE Server release 26.4.303, September 11, 2026
• NVD: CVE-2026-110447, checked October 24, 2026
• CISA: CISA Adds One Known Exploited Vulnerability to Catalog, October 23, 2026
• CISA: Known Exploited Vulnerabilities Catalog (CVE-2026-110447, added October 23, 2026, due October 26, 2026; catalog version 2026.10.23, checked October 24, 2026)
• Nextcloud community forum: To Collabora Built-in User: Update ASAP, October 3, 2026, with later replies
• Nextcloud App Store: Collabora Online - Built-in CODE Server, checked October 24, 2026