If your Nextcloud server has the “Collabora Online – Built-in CODE Server” app, check its version now. The app’s security advisory says versions before 26.4.303 can let an unauthenticated attacker run commands on the server when its built-in document server is not running. Update the app to 26.4.303 or later, or remove it if you cannot update. CISA added the flaw to its list of vulnerabilities known to be exploited on October 23. This is not a flaw in every Nextcloud installation or in standalone Collabora Online.

What happened?

The issue, CVE-2026-110447, is in the richdocumentscode app’s proxy. The Collabora advisory published October 14 says a request can make the operating system run a command as the web-server user. That requires the built-in CODE server to be stopped, such as during a restart, upgrade or crash. The advisory rates the flaw critical and names app version 26.4.303 as the fix.

CISA’s Known Exploited Vulnerabilities catalog lists this CVE with an October 23 addition date. A Nextcloud community report also describes web shells found on individual servers. A web shell is a file an attacker can use to control a server remotely. These reports make the issue urgent, but they do not mean that every installation was breached.

Collabora says disabling the affected app is not enough. If you cannot update it, remove it. Using only the separate richdocuments integration with an external or hosted Collabora server does not, by itself, put the vulnerable built-in richdocumentscode app on your server. Standalone Collabora Online servers are outside this advisory. The vendor also says a fix for the earlier CVE-2025-66208 does not fix this issue.

What should you do?

1. Check the installed app. A Nextcloud administrator should open the app-management area and look specifically for Collabora Online – Built-in CODE Server (richdocumentscode). Record its installed version. If a host manages Nextcloud for you, ask the host to check this app and report the result. Do not confuse it with the separate richdocuments app.
2. Back up, then update or remove. Install richdocumentscode 26.4.303 or later through your supported Nextcloud app-update process. If the fixed app cannot be installed, arrange to remove the vulnerable app rather than only disabling it. Check that document editing still works after the change, or plan an alternative editor. If you run an end-of-life Nextcloud release at version 29 or earlier, Collabora advises upgrading Nextcloud or removing the app.
3. Check for signs of compromise. If the app was exposed while the built-in server was stopped, ask your administrator or incident-response team to review app-integrity alerts, unexpected files and relevant access logs. Preserve evidence before cleaning anything. If there are signs of intrusion, follow your incident-response process and rotate credentials the web-server user could access. An update closes the bug; it does not undo an earlier intrusion.
4. Verify service. Confirm the installed app version, test document opening and editing, and check that the public site and administrator area respond. Keep watching vendor advisories for further instructions.

For administrators, Nextcloud’s app-management documentation describes the supported app-management workflow. Verify the release you actually install. A server package or container running standalone Collabora is not the same as the bundled Nextcloud app.

Sources: Collabora’s CVE-2026-110447 advisory; CISA KEV catalog; Nextcloud community report and discussion. CISA’s listed October 26 remediation date is a federal-agency deadline, not a blanket deadline for every website owner.

Image: Original editorial composition using the Nextcloud symbol shared by openDesk on Wikimedia Commons, under the Apache License 2.0. The paper shapes are illustrative, not a screenshot. The vulnerability is in an optional built-in Collabora app, not Nextcloud core.