Unauthenticated command injection in Nextcloud's Collabora Built-in CODE Server proxy.php (CVE-2026-110447)
The CVE was published on 2026-10-14 and VulnCheck added it to its known-exploited catalog the same day, with Nextcloud community reports of webshells already planted on servers running richdocumentscode 26.4.302 or older, so an instance left unpatched is a live target for full server compromise.
The Collabora Online Built-in CODE Server app for Nextcloud (richdocumentscode) starts Collabora through a PHP exec call in proxy.php, and an unauthenticated attacker can inject OS commands when the bundled CODE server is not running, for example right after a restart. Successful exploitation gives arbitrary command execution on the Nextcloud host; operators have reported finding webshells on affected servers. Standalone Collabora servers (Docker, distribution packages, hosted Collabora) are not affected.
Affected: Collabora Online - Built-in CODE Server (richdocumentscode) Nextcloud app < 26.4.303 (26.4.302 and older)
How to Test
In Nextcloud's Apps page (or via occ app:list) check whether 'Collabora Online - Built-in CODE Server' (richdocumentscode) is installed and whether its version is 26.4.302 or lower; if you only have the richdocuments app pointing at a separate Collabora server (Docker, distro package, or a hosting provider) you are not affected. If you ran a vulnerable version, review web server access logs for unauthenticated requests to the richdocumentscode proxy.php endpoint, especially around times the CODE server was stopped or restarting, and search the Nextcloud web root and data directories for unexpected PHP files or webshells and the web server user for unexpected processes.
How to Patch
Update the Collabora Online - Built-in CODE Server (richdocumentscode) app to 26.4.303 or later from the Nextcloud app store. If you cannot update immediately, remove or disable the richdocumentscode app and point richdocuments at a standalone Collabora Online server instead.