Nextcloud richdocumentscode proxy RCE is CVE-2026-110447

What happened

On 14 October 2026 MITRE published CVE-2026-110447 for Collabora Online - Built-in CODE Server (richdocumentscode), the Nextcloud app that downloads and runs a local CODE AppImage. The CVE describes OS command injection in proxy.php when the CODE server is not running, for example after a restart, leading to remote code execution. It states the issue was exploited in the wild in September and October 2026 and is distinct from CVE-2025-66208. Standalone Collabora Online is not affected.

MITRE scores it CVSS 4.0 9.2 (Critical) with no privileges required and attack requirements present. NVD lists that Secondary metric. No HackerOne or nextcloud/security-advisories GHSA for this ID was located at research time, and the CVE credits field names no researcher.

The fixed app release 26.4.303 was tagged on GitHub on 11 September 2026.

Who is affected

Nextcloud instances with richdocumentscode before 26.4.303 installed and enabled. Public guidance from the Nextcloud forum post and Collabora issue thread says you are not in this path if you only use the richdocuments connector without richdocumentscode, or if you run Collabora via Docker, a Linux distribution package, or a hosted Collabora service.

The MITRE description frames a precondition that the CODE server is not running at the time of the request. Attack traffic reported by operators targeted the app’s proxy.php status endpoint without authentication.

What is confirmed

The MITRE/CVE.org text confirms OS command injection in proxy.php, the built-in CODE-only scope, the difference from CVE-2025-66208, the 26.4.303 fixed line, CVSS 4.0 9.2, and in-the-wild exploitation in September and October 2026.

On CollaboraOnline/richdocumentscode issue 354, operators reported September 2026 compromises that wrote PHP webshells under the app tree after requests to /apps/richdocumentscode/proxy.php?status. Collabora maintainer responses told victims to upgrade to 26.4.303 and remove lingering shx*.php files. The Nextcloud help forum post of 3 October 2026 likewise warned that the shell-injection bug was already being exploited and that users had found webshells.

The CVE is not in the CISA KEV catalog (catalog version 2026.10.13). ThreatWire found no dedicated coverage from BleepingComputer, The Record, SecurityWeek, or The Hacker News for CVE-2026-110447. No named commercial threat-intel vendor report with campaign scale was found; the public primary exploitation trail is the CVE wording plus operator reports on the Collabora GitHub issue and the Nextcloud forum note.

No public GitHub repository that credibly claims a PoC for CVE-2026-110447 was found for a pocUrl field.

What is not confirmed

CISA KEV listing and any federal due date. A formal Collabora or Nextcloud GHSA with a credited finder. Exact global victim counts or attribution to a named ransomware brand (one GitHub comment alleged ransomware abuse; that claim is not independently corroborated here).

What to do

Update the Collabora Online - Built-in CODE Server app to 26.4.303 or later through the Nextcloud app store. Collabora maintainers also advised removing unexpected PHP files under the app directory, including names matching shx*.php.

If you do not need built-in CODE, disable or uninstall richdocumentscode and prefer a standalone Collabora deployment (Docker or distro package) as described in the Nextcloud forum guidance. After a compromise suspicion, treat the host as untrusted: rotate credentials, review web logs for proxy.php abuse, and rebuild from known-good backups if webshells were present.

Sources: CVE.org / NVD for CVE-2026-110447; CollaboraOnline/richdocumentscode issue 354 and tag 26.4.303; Nextcloud help forum “To Collabora Built-in User: Update ASAP”; CISA KEV catalog 2026.10.13 (not listed).