Cybersecurity experts are on high alert as hackers exploit a significant vulnerability in the Collabora Online Built-in CODE Server app for Nextcloud. Users have reported unauthorized web shells on compromised servers, raising concerns about system integrity and data security.
Understanding the CVE-2026-110447 Vulnerability
The identified flaw, tracked as CVE-2026-110447, allows remote attackers to execute operating system commands without authentication. This vulnerability affects the richdocumentscode app versions earlier than 26.4.303, and is rated with a severe CVSS v4 score of 9.2, indicating a major security risk.
According to the GitHub Advisory Database, the flaw was actively exploited in September and October 2026. On October 3, the Nextcloud community forum issued a warning after users detected web shells on their servers, highlighting the potential for persistent unauthorized access.
Technical Details and Exploitation Conditions
The vulnerability resides in the proxy.php component of the application, which manages Collabora’s built-in document server within a Nextcloud environment. A strategically crafted request can prompt this server to execute operating system commands as the web server user. This issue is known as CWE-78, or operating system command injection.
Importantly, exploitation occurs without needing user credentials or interaction. However, the attack requires that the built-in CODE server is inactive when the malicious request is received, which can occur during routine operations such as container restarts, upgrades, or crashes.
Mitigation and Prevention Measures
Administrators are advised to update the richdocumentscode app to version 26.4.303 or later, or alternatively, remove the app entirely. Merely disabling the app does not suffice to prevent exploitation. Collabora recommends users running outdated Nextcloud versions 29 or earlier to upgrade their systems or remove the vulnerable app.
For systems previously at risk, administrators should scrutinize for unusual PHP files as part of their security protocols. While updating the software addresses the vulnerability, it does not guarantee the removal of any web shells that may have been planted. Therefore, checking for signs of intrusion remains a critical step post-patching.
As cyber threats evolve, it is essential to continuously update defenses against emerging malware and integrate threat intelligence feeds from various security operations centers.
