CVE-2026-110447 is a critical (CVSS v4.0 9.2) OS command injection in the Collabora Online Built-in CODE Server (richdocumentscode), a Nextcloud app, that lets a remote, unauthenticated attacker run operating system commands as the web server user. According to the Collabora advisory, the attack only works while the built-in CODE server is not running, such as after a container restart, an upgrade, or a crash, and disabling the app does not avoid it. The CVE record states the flaw was exploited in the wild in September and October 2026. Censys currently detects 19,454 hosts and 103,350 web properties with the app installed.
Details
| CVE ID | CVE-2026-110447, CVSS v4.0 9.2 (Critical) |
| Date of Disclosure | October 14, 2026 |
| Affected Assets | Nextcloud deployments running the Collabora Online Built-in CODE Server app (richdocumentscode). Standalone Collabora Online servers are not affected. |
| Vulnerable Software Versions | richdocumentscode before 26.4.303 |
| PoC Available | Not confirmed. |
| Exploitation Status | The CVE record reports exploitation in the wild in September and October 2026. As of October 16, 2026, the CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. |
| Patch Status | Fixed in version 26.4.303, released September 11, 2026. Note: this release requires Nextcloud 30 or later. |
Affected Assets
The Collabora advisory lists richdocumentscode versions earlier than 26.4.303 as vulnerable and 26.4.303 as patched. This vulnerability only impacts the Nextcloud deployment that uses the Built-in CODE Server app; standalone Collabora Online servers are not affected.
Release 26.4.303 requires a minimum Nextcloud version of 30, so end-of-life instances on Nextcloud 29 and earlier should be upgraded or the app should be removed.
Censys Query
We currently detect 19,454 hosts and 103,350 web properties running the app, based on the following Censys Platform query:
host.services.endpoints.http.body: "richdocumentscode"
or web.endpoints.http.body: "richdocumentscode"These counts include pages that reference richdocumentscode_arm64, a separate Nextcloud app for ARM64 systems (1,001 hosts and 4,571 web properties). However, the Collabora advisory names only richdocumentscode and does not state whether the ARM64 app is also affected.
PoC Available?
As of October 16, 2026, no public proof-of-concept has been released for CVE-2026-110447. Administrators with compromised instances have published observed requests, a webshell description, and other indicators in the richdocumentscode issue tracker.
Exploitation Status
The CVE record states that the flaw was exploited in the wild in September and October 2026. Administrators reported the activity in the richdocumentscode issue tracker, where the reporter’s logs show the first malicious request on September 16, 2026.
Per those administrator reports, attackers sent crafted GET requests to /apps/richdocumentscode/proxy.php?status using encoded path traversal and shell command substitution, and wrote PHP webshells named shx*.php into the app directory. On one server, the attacker ran commands searching for credential and cryptocurrency wallet files. The reporter observed the same attack pattern and webshell family on multiple independent Nextcloud installations.
As of October 16, 2026, CVE-2026-110447 is not listed in the CISA KEV catalog.
Patch Status
- Upgrade
richdocumentscodeto 26.4.303 or later, or remove the app. Collabora’s advisory states that disabling the app is not sufficient. The fix was released September 11, 2026. - On Nextcloud 29 or earlier, upgrade Nextcloud or remove the app. The fixed release requires Nextcloud 30 or later, and Collabora gives this direction for end-of-life Nextcloud.
Patching does not remove existing webshells. Vulnerable servers that were accessible from the internet since at least September 10, 2026 warrant investigation regardless of their current patch state. Administrators in the issue tracker reported the following indicators:
shx*.phpfiles in therichdocumentscodeapp directory- web server access log entries for
/apps/richdocumentscode/proxy.phpcontaining%2e%2epath traversal - an unfamiliar PHP file flagged by Nextcloud’s integrity check