CISA Adds the Nextcloud Collabora CODE Flaw to KEV: Update It or Remove It

CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on October 23, with a remediation due date of October 26. It’s an OS command injection in Collabora Online – Built-in CODE Server (the richdocumentscode app) when it runs inside Nextcloud. CISA flags it as needing forensic triage.

What’s going on

• The app’s proxy.php starts the local CODE server when nothing is listening. Up to 26.4.302 it dropped text from the request into a double-quoted bash command, so $(...) in the path ran as the web server user. No login needed.
• It only works while the CODE server is down (restart, upgrade, crash), which is a lot more often than you’d think.
• Admins reported web shells planted starting September 10, plus hunts for password vaults and crypto wallets. No reports of root.
• Fixed in 26.4.303. Disabling the app does not fix it. Update it or remove it. Nextcloud 29 and older can’t get the fix, so upgrade Nextcloud or remove the app.
• Standalone Collabora servers, and setups using only Nextcloud Office (richdocuments) with a separate Collabora server, aren’t affected.

What to do

sudo -u www-data php occ app:update richdocumentscode
sudo -u www-data php occ app:list | grep -A1 richdocumentscode
find apps/richdocumentscode -name 'shx*.php'

Then grep your access logs back to September 10 for proxy.php?status requests with %2e%2e, $( or ${IFS} in the path. If you find a hit, treat anything the web server account could read as exposed and rotate it.

My take

The fix shipped quietly on September 11 with no security note, and the CVE didn’t land until October 14. That’s the lesson: on anything internet-facing, take the update even when the release notes look boring.

Have a blessed day! And Happy Hacking!

References & Further Reading

• CISA Adds One Known Exploited Vulnerability to Catalog (Oct 23)
• Known Exploited Vulnerabilities Catalog (CISA)
• Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App (The Hacker News)
• Collabora Online advisory GHSA-g3vx-3m76-fghh (GitHub)
• Collabora Built-in CODE Server releases (Nextcloud App Store)