CVE-2026-110447

Collabora Online CODE Server is the document-editing engine bundled with Nextcloud that lets people edit Word/Excel-style files in a browser. Think of it like a translator window between your files and the editor — if that translator briefly goes offline (say, during a restart), an attacker can slip commands through the empty doorway and take control of the whole server. From there they can plant malicious tools, steal passwords, and lock up your files for ransom.

This matters to you if your organization runs Nextcloud with the built-in Collabora Online CODE Server app (not a separate, standalone Collabora server — those are not affected). It applies specifically to the bundled richdocumentscode component on versions before 26.4.303, and no login or user interaction is needed for an attacker to exploit it when the CODE server process happens to be down.

Attackers are already exploiting this flaw in the wild — multiple Nextcloud servers were compromised in mid-September 2026 by ransomware operators using it to plant webshells and encrypt data. This is not a theoretical risk; treat any unpatched instance as actively targeted and patch now, not on a routine schedule.

Confirm exposure by checking whether the Nextcloud 'richdocumentscode' app (built-in Collabora CODE Server) is installed and its version. Versions before 26.4.303 are vulnerable. Upgrade to 26.4.303 or later as soon as possible — this is the vendor-confirmed fix. There is no documented safe workaround other than ensuring the CODE server process is never left stopped/restarted without immediate recovery, since the injection path through proxy.php only opens when the backend process is offline; this is not a reliable mitigation and should not replace patching. CISA has not listed this in KEV, so there is no federal remediation deadline, but given confirmed ransomware exploitation since September 2026, treat it with KEV-level urgency internally. After patching, audit for indicators of compromise: unexpected PHP files in web-accessible directories (webshells), unusual outbound connections, searches for credential stores or cryptocurrency wallet files, and any ransomware artifacts, particularly if the instance was unpatched and internet-facing between September and October 2026.

CWE-78 (OS Command Injection) in proxy.php within the richdocumentscode (CODE Server) Nextcloud app, exploitable over the network without authentication or user interaction when the CODE server backend process is not actively running. Confirmed in-the-wild exploitation since September 2026 by ransomware operators deploying webshells and conducting credential/wallet theft; not currently in CISA's KEV catalog. No public exploit code is on record, but real-world incidents supersede the EPSS prediction for urgency purposes. Fixed in version 26.4.303. Distinct from CVE-2025-66208; standalone Collabora Online deployments (without the bundled CODE Server) are not affected.