CVE-2026-110447: Collabora Online Built-in CODE Server OS Command Injection in Nextcloud

Overview

CVE-2026-110447 is an unauthenticated OS command injection in the Collabora Online – Built-in CODE Server app (richdocumentscode) used with Nextcloud. It carries a CVSS v4.0 score of 9.2 (Critical) and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog.

The flaw sits in the app's proxy.php. It can be triggered when the local CODE server is not running, for example after a restart, an upgrade or a crash, and lets a remote attacker run commands as the web server user.

Affected Products

Reported as not affected: standalone Collabora Online servers, Docker and RPM/DEB installs, Nextcloud All-in-One, and the core Nextcloud platform.

Exploitation Status

Active exploitation and PHP web shell deployment have been reported since September 10, 2026. Compromised servers show web shells under apps/richdocumentscode/ with names such as shx*.php. This is a different code path from CVE-2025-66208, so that earlier fix does not cover it.

Mitigation

1. Update the app to 26.4.303 or later, or remove it entirely. Merely disabling the app is reported to be insufficient.
2. Hunt for compromise: look for unexpected PHP files under apps/richdocumentscode/, and anomalous requests to proxy.php in web server logs.
3. If a web shell is found, treat the host as compromised: rotate Nextcloud and database credentials and review for persistence.
4. Prefer a standalone Collabora deployment over the built-in server to shrink the attack surface.

References

• NVD — CVE-2026-110447
• Upwind threat post on CVE-2026-110447
• CISA KEV Catalog