Collabora Online Built-in CODE Server command injection (CVE-2026-110447)

The Built-in CODE Server app for Nextcloud runs a Collabora server inside Nextcloud. The flaw is in the way the app starts that server from its PHP file, proxy.php. Collabora's advisory says that a request to this file can run an operating system command as the web server user. No login is needed. It is remote code execution on the Nextcloud host.

The Condition Collabora Describes

The attack works while the built-in CODE server is not running. That is the case after a container restart, after an upgrade or after a crash. Collabora says it is not enough to disable the app. The app must be upgraded to 26.4.303 or later, or removed. It also says this is a different path from CVE-2025-66208, and the fix for that older issue does not stop it.

What Attackers Did

In the GitHub issue, an admin who hosts several Nextcloud servers posted access log lines from 10 and 11 September. They show requests to proxy.php?status with shell syntax in the URL path. The reporter says the requests created PHP web shells in the app folder, with names that start with shx or shrf. Italy's national CSIRT said on 16 October that it saw active exploitation, with web shell installation and credential theft. The NVD text says exploitation took place in September and October 2026.

What Our Checks Showed

GitHub: two public repositories name the id. One, created on 14 October, holds a script that calls itself a lab proof of concept. We read it and did not run or link it.

X: our searches returned 86 unique public posts from 14 to 23 October, among them Censys, who counted 19,454 hosts with the app installed on 16 October.

Dark web: on 16 October a Telegram channel advertised a tool for the flaw for 40 USDT, a dollar-pegged cryptocurrency, with a list of 10,000 targets. On 20 October another channel offered a script it said could scan target lists and drop a web shell. We have not verified either claim.

Our Nextcloud Collabora news post has the checks, the quotes and the steps for a server that was exposed.

Collabora's advisory lists the app richdocumentscode (Collabora Online - Built-in CODE Server) in versions before 26.4.303. A community member on the Nextcloud forum names 26.4.302 and older. The fixed release is 26.4.303, published on 11 September 2026.

• Nextcloud servers that have the Built-in CODE Server app installed. Disabling it does not remove the risk.
• Nextcloud 29 and older. The advisory tells users of these releases to upgrade Nextcloud or remove the app. The app store listed 26.4.104 for Nextcloud 25 to 29, which is older than the fix.

Not Affected

Collabora says standalone Collabora Online servers are not affected. Its 15 October blog post adds Docker images, RPM and DEB packages and Nextcloud All-in-One images.

How Many Servers Run the App?

On 16 October Censys said it detected 19,454 hosts and 103,350 web properties with the app installed, and added that not all were confirmed vulnerable.