Attackers were exploiting a critical flaw in Collabora Online's built-in CODE Server app for Nextcloud for about a month before a CVE identifier or public advisory existed. The bug, now tracked as CVE-2026-110447, is an unauthenticated OS command injection in the app's proxy.php endpoint. It affects the richdocumentscode Nextcloud app in versions before 26.4.303.
The NVD record, published October 14, 2026, says the flaw allows remote code execution "as exploited in the wild in September and October 2026." Collabora's advisory, GHSA-g3vx-3m76-fghh, rates it Critical with a CVSS v4 base score of 9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and classifies it as CWE-78. As of October 19, the vulnerability was not listed in CISA's Known Exploited Vulnerabilities catalog, so no federal remediation deadline applies.
Which installs are affected
The vulnerable component is the "Built-in CODE Server" app, which bundles a Collabora Online Development Edition server inside Nextcloud. BleepingComputer reports that the flaw lies in how the app starts that bundled server. NVD says standalone Collabora Online servers are not affected. Docker and RPM/DEB installs and Nextcloud All-in-One deployments are also unaffected, according to Collabora as cited by BleepingComputer.
Collabora's advisory sets two conditions on exploitation. Injected commands run as the web server user, and the attack works only while the built-in CODE server is not running, for example after a container restart, an upgrade or a crash. No authentication or user interaction is required.
NVD and Collabora both describe this as a different vulnerability from CVE-2025-66208, an earlier flaw in the same app. Collabora's advisory says the fix for that earlier issue does not prevent this one, so a patch for CVE-2025-66208 offers no protection here.
Collabora credits the report to a researcher identified as wwwshellcodeit.
How the disclosure unfolded
The fix shipped well before the advisory did. BleepingComputer reported this sequence on October 15:
- September 9: The fix was committed.
- September 10: Attacks exploiting the flaw began, according to administrator reports cited by BleepingComputer.
- September 11: Version 26.4.303, containing the fix, was released.
- Mid-September: Maintainers issued warnings.
- October 3: A community warning on the Nextcloud forum urged users to update immediately.
- October 14: Collabora published its GitHub advisory and the CVE was published.
That left 35 days between the fix commit and the CVE, a gap BleepingComputer describes as more than four weeks.
Nextcloud told BleepingComputer that Collabora reported the flaw in mid-September and that an update was available through the Nextcloud app store. The company said the disclosure delay gave users time to update, and that it had not observed widespread exploitation. In a blog post cited by BleepingComputer, Collabora attributed the late announcement mainly to backlogs in GitHub's CVE processing, which it said are strained by a rising volume of AI-driven security reports.
BleepingComputer also cited an analysis of open-source flaws by Second Security, which found the median gap between a public fix and CVE publication was 39 days in August, up from 5.1 days in January. The firm found that in many cases public exploit code appeared within hours of a fix and several days before the CVE was published, and said AI tools make it easier to build exploits from published fixes.
What attackers did after getting in
According to BleepingComputer, the attackers planted PHP webshells and used them to search compromised hosts for password databases, password-manager artifacts and cryptocurrency wallets. Some users claimed that ransomware operators were exploiting the flaw. BleepingComputer said it could not confirm those claims, and none of the cited sources attributes the activity to a named group.
Remediation
Collabora's advisory says disabling richdocumentscode is not sufficient. It lists two remediations: upgrade to 26.4.303 or later, or remove the app. It also notes that Nextcloud 29 and earlier are end-of-life, and that users on those releases should upgrade Nextcloud or remove the app.
What It Means for Defenders
- Assume earlier exposure. Any instance that ran a vulnerable version after early September should be checked for compromise even if it is patched now. Updating does not remove a webshell that is already in place.
- Hunt for webshells. Look for unexpected or recently modified PHP files in the Nextcloud web root and app directories. Review web server logs for unusual requests to the app's proxy endpoint, and look for processes started by the web server user.
- Rotate exposed secrets. If you find signs of compromise, assume that credentials and files reachable by the web server user were read. Rotate the Nextcloud database and service credentials, app passwords and any secrets stored in synced files.
- Track vendor channels, not just CVE feeds. Here the fixed release and a forum warning preceded the CVE by weeks. Vendor release notes and project forums are worth monitoring for internet-facing collaboration software.
