Collabora’s October 14, 2026, advisory warns that the optional Nextcloud app Collabora Online - Built-in CODE Server is vulnerable to CVE-2026-110447 in versions earlier than 26.4.303. Disabling the app is not enough: administrators must update it to 26.4.303 or later, or remove it, according to Collabora’s security advisory.
Which Nextcloud component is affected?
The flaw affects the optional richdocumentscode app, listed in Nextcloud as Collabora Online - Built-in CODE Server. Collabora classifies it as Critical. Its advisory says standalone Collabora Online servers are not affected.
When can the flaw be exploited?
An unauthenticated request to proxy.php can trigger operating-system command execution as the web-server user—but only when the built-in CODE server is not running, such as during a restart or upgrade, or after a crash. “Unauthenticated” means the request does not require a login.
What should administrators do?
Upgrade richdocumentscode to 26.4.303 or later, or remove the app. Simply disabling it does not resolve the vulnerability, Collabora says. For installations on Nextcloud 29 or older, Collabora advises upgrading Nextcloud or removing the app.
The release record for version 26.4.303 dates its release to September 11, 2026.
What was reported about attacks?
The Hacker News reported that administrators’ logs showed attack activity beginning September 10, 2026, a day before the patched version was released. Its October 14 report recounted compromise reports from three administrators. Those accounts are reports from individual administrators, not a count of affected servers. The Hacker News
