Nextcloud: Built-in Collabora Server (CODE) Exploited, CVE-2026-110447 Added to CISA KEV

CVE-2026-110447 hits Nextcloud's built-in Collabora server, the Collabora Online – Built-in CODE Server app (richdocumentscode). It's the all-in-one option that lets you edit office documents inside Nextcloud without running a separate Collabora server, popular on small instances and self-hosted setups.

NVD published it on October 14, 2026; CISA added it to the KEV catalog on October 23, with a deadline of October 26. The NVD description states it was exploited in the wild in September and October 2026 — in other words, exploitation started before the CVE was published.

The vulnerability

The only published score is a CVSS 4.0 from MITRE as the CNA; there is no CVSS 3.1 score. NVD has marked the entry Deferred: it won't be analyzed as a priority and has no CPE configuration.

From the NVD description:

This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.

How it works: a window at startup

With the richdocumentscode app, the Collabora server (CODE) runs inside the Nextcloud instance itself, started and fronted by a proxy.php script. The flaw sits in that script, and only while the CODE server isn't running — right after a restart, for example.

That's what AT:P ("attack requirements present") captures in the vector: the attack depends on a condition outside the attacker's control. The description doesn't say whether an attacker can bring that state about. But the example it gives, a recent restart, is hardly rare: a server, container or web service restart, a Nextcloud upgrade.

Once the condition holds, no authentication is needed, and the result is command execution on the server with the web process's privileges. On a Nextcloud instance, those privileges reach every user's files and the configuration file, which holds the database credentials.

Who's affected, who isn't

• Affected: any Nextcloud instance with the Built-in CODE Server app (richdocumentscode) installed, on a version before 26.4.303.
• Not affected, per NVD: standalone Collabora Online servers (a separate deployment, Docker or package) connected to Nextcloud through the "Nextcloud Office" app (richdocuments).

The description also notes that this is a different vulnerability from CVE-2025-66208: if you dealt with that one, this one still needs doing.

Versions

NVD says before 26.4.303, so 26.4.303 is the first version of the richdocumentscode app outside the vulnerable range. NVD has no CPE configuration for the entry; the references to follow are the announcement thread on the Nextcloud forum ("To Collabora built-in user: update ASAP"), GitHub issue richdocumentscode #354, and the Collabora GitHub advisory cited by CISA.

Check the installed version from your Nextcloud directory:

sudo -u www-data php occ app:list | grep -A1 richdocumentscode

(Swap in whichever user runs your web server.)

Detection

Exploitation started in September, so patching today tells you nothing about what happened before. The KEV entry points to the forensic triage requirements of directive BOD 26-04.

• Access logs: requests to the richdocumentscode app's proxy.php with unusual parameters, especially in the minutes after a restart
• Processes spawned by the web server user (www-data, apache, nginx…): shells, curl, wget, cryptominers
• PHP files new or modified in the Nextcloud directory outside an upgrade; occ integrity:check-core can check integrity
• Scheduled tasks (the web user's crontab) added for no reason
• Outbound connections from the Nextcloud server to unknown destinations

Mitigation

1. Update the richdocumentscode app to 26.4.303 or later (occ app:update richdocumentscode). The CISA deadline is October 26.
2. If you can't update right away: disable the app (occ app:disable richdocumentscode). Online document editing stops, but so does the entry point.
3. Longer term, for an internet-facing instance or one with many users: consider a standalone Collabora Online server, which NVD says this flaw doesn't affect.
4. If you suspect compromise: assume user files may have been read, rotate the database password and the secrets in config.php, and review Nextcloud admin accounts and recently installed apps.

Why continuous monitoring of your self-hosted apps matters

An app installed in one click "to get online editing", updated separately from Nextcloud, that nobody looks at: that's exactly the component that slips through an inventory. This one was being exploited for weeks before a CVE was even published.

With cveo.tech, inventory your self-hosted applications and their add-ons with versions, and get an alert as soon as a CISA KEV entry affects them.