Zero Radar
← feed
CriticalVulnerabilityCVE-2026-110447updated 26 Oct 2026, 12:05 UTC

Collabora Online CODE Server in Nextcloud can let attackers run commands on the server

A flaw in the document editing server bundled with the Nextcloud app lets an outsider send a crafted request and run commands on the machine. Attackers are already using it.

Exploited (CISA KEV, NVD)Fix availableOfficial, 5 sources
SeverityCriticalCVSS 9.2 of 10
Being exploited?YesConfirmed by CISA KEV, NVD · 23 Oct 2026
Fix available?YesVersion 26.4.303 or later of the richdocumentscode app. · since 25 Oct 2026
How sure is this?Official, 5 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestCrafted request to proxy.php
  2. 2CODE server is downHappens after a restart
  3. 3Command injectionUnsanitized input reaches the OS
  4. 4Code runs on serverAttacker gains remote execution
  5. ResultAttacker controls the Nextcloud server

What happened

An OS command injection in proxy.php of the built-in CODE Server (richdocumentscode Nextcloud app) allows remote code execution when the CODE server is not running, such as after a restart.

Why it is dangerous: A successful attack gives the attacker control of the server hosting Nextcloud and its files. Organizations running Nextcloud with this app and internet exposure are at highest risk.

Are you affected?

You are affected if you run the richdocumentscode (Collabora Online built-in CODE Server) Nextcloud app before 26.4.303 and the CODE server is not running, for example after a recent restart.

Collabora Online Built-in CODE Server (richdocumentscode Nextcloud app) before 26.4.303. Standalone Collabora Online servers are not affected.

What to do

  1. Update the richdocumentscode (Collabora Online built-in CODE Server) app to version 26.4.303 or later
  2. If you cannot update right away, make sure the CODE server is running, or disable the app until you can patch
  3. Review your Nextcloud server for signs of compromise, especially if the app was unpatched and the CODE server was restarted
  4. Limit internet exposure of the Nextcloud instance where possible

Timeline

  1. 14 Oct 2026, 03:17 UTC
    Publicly disclosed
  2. 23 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 24 Oct 2026, 06:25 UTC
    Reported by The Hacker News · The Hacker News
  4. 25 Oct 2026, 15:20 UTC
    CISA reported on it · CISA
  5. 25 Oct 2026, 17:20 UTC
    GitHub Advisory reported on it · GitHub Advisory
  6. 25 Oct 2026, 17:20 UTC
    Fix: 26.4.303 (richdocumentscode)
  7. 26 Oct 2026, 12:05 UTC
    NVD reported on it · NVD

Sources 5 reports, oldest first

Official vendor, government CERT or advisory database

Security press established security newsrooms

Technical details

ID
CVE-2026-110447 · GHSA-f97p-r72q-64h2
CVSS
9.2 / 10
EPSS
73% chance of exploitation within 30 days
Disclosed
14 Oct 2026, 03:17 UTC
On Zero Radar
before the radar started
Last change
26 Oct 2026, 12:05 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Collabora Online CODE Server in Nextcloud can let attackers run commands on the server · Zero Radar