The scope

A narrow condition, but a serious result

Collabora says the Nextcloud app called Collabora Online – Built-in CODE Server, or richdocumentscode, can allow an unauthenticated request to run an operating-system command as the web-server user. The flaw is in proxy.php and is exploitable while the built-in CODE server is not running—for example, after a restart, upgrade or crash. CISA added CVE-2026-110447 to its exploited-vulnerabilities catalog on 23 October.

Versions before 26.4.303 are affected. Collabora says standalone Collabora Online servers are not affected, and the earlier CVE-2025-66208 fix does not cover this path.

Do not stop at disabled

Collabora explicitly says disabling the Nextcloud app is insufficient. Upgrade it to 26.4.303 or later, or remove it. For end-of-life Nextcloud 29 and earlier, upgrade Nextcloud or remove the app.

Defender note

Check installation state and signs of prior access

  1. 1

    Find the component. Inventory Nextcloud instances and confirm whether richdocumentscode is installed. Separate these from standalone Collabora deployments.

  2. 2

    Upgrade or remove. Apply version 26.4.303 or later, or remove the app. Verify the deployed files and active version rather than relying on a disabled-state toggle.

  3. 3

    Review the exposure window. Preserve web and host logs around service restarts and crashes. Investigate unexpected web-server child processes, changed application files and outbound connections, especially where the instance was internet reachable.

A vulnerable installation is not proof of compromise. Equally, a quiet current scan cannot reconstruct what happened during an earlier restart. Keep the remediation result and the compromise assessment as separate findings.