Collabora Online Built-in CODE (richdocumentscode) CVE-2026-110447 (CVSS 4.0 9.2): unauthenticated OS command injection via proxy.php backdoors Nextcloud servers while the local CODE process is down; fixed in 26.4.303

Collabora published GHSA-g3vx-3m76-fghh on 14 October 2026 for CVE-2026-110447 in the optional Nextcloud app Collabora Online - Built-in CODE Server (package richdocumentscode). When the local CODE process is not running (restart, upgrade, or crash), an unauthenticated HTTP request can inject OS commands through proxy.php because request path text was placed inside a double-quoted bash command up to 26.4.302. Attackers used that window to plant web shells; admins reported first hits from 10 September 2026, with request markers such as %2e%2e, $(, ${IFS}, and base64 -d piped to sh. Collabora rates it Critical (CVSS 4.0 9.2), fixed the bug in 26.4.303 on 11 September, and warns that disabling the app is not enough — it must be upgraded to ≥ 26.4.303 or removed. Standalone Collabora Online servers are not affected; installs that use only the Nextcloud Office app (richdocuments) against an external Collabora server are not affected. Fixed builds need Nextcloud 30 or later; EOL Nextcloud ≤ 29 still receive an affected app-store build and should upgrade Nextcloud or remove the app. This path is separate from CVE-2025-66208 in the same script.

Product

Collabora Online - Built-in CODE Server (richdocumentscode) on Nextcloud

Versions

Affected: richdocumentscode < 26.4.303. Patched: 26.4.303 (requires Nextcloud 30+). Not affected: standalone Collabora Online; Nextcloud Office (richdocuments) alone with an external Collabora server. EOL Nextcloud ≤ 29: remove the built-in app or upgrade Nextcloud.

CVSS

9.2 (Collabora, CVSS 4.0 Critical)

Exploited in Australia?

unknown

Patch to

Upgrade richdocumentscode to 26.4.303 or remove the Built-in CODE app. Do not rely on disabling it. On Nextcloud ≤ 29, upgrade the platform or remove the app. Hunt for webshells and unusual proxy.php path patterns if the app was present during September–October.

Primary: Collabora GHSA-g3vx-3m76-fghh — Unauthenticated OS command injection in richdocumentscode proxy (CVE-2026-110447, 14 Oct 2026) · Vendor: Collabora Online security advisory (affected < 26.4.303; patched 26.4.303) · CVE: CVE-2026-110447, CVE-2025-66208 · The Hacker News — Hackers backdoor Nextcloud servers via Collabora Built-in CODE (14 Oct 2026); also apps.nextcloud.com/apps/richdocumentscode

vulnerabilities cloud