Thursday, October 15, 2026 — 1 issue requires action. If you run none of the software below, you are done.

Affects: Collabora Online - Built-in CODE Server Nextcloud app

1. Unauthenticated command injection in Nextcloud's Collabora Built-in CODE Server proxy.php (CVE-2026-110447)

REMOTE CODE EXECUTION · CRITICAL · CVSS 9.2

The CVE was published on 2026-10-14 and VulnCheck added it to its known-exploited catalog the same day, with Nextcloud community reports of webshells already planted on servers running richdocumentscode 26.4.302 or older, so an instance left unpatched is a live target for full server compromise.

The Collabora Online Built-in CODE Server app for Nextcloud (richdocumentscode) starts Collabora through a PHP exec call in proxy.php, and an unauthenticated attacker can inject OS commands when the bundled CODE server is not running, for example right after a restart. Successful exploitation gives arbitrary command execution on the Nextcloud host; operators have reported finding webshells on affected servers. Standalone Collabora servers (Docker, distribution packages, hosted Collabora) are not affected.

Affected: Collabora Online - Built-in CODE Server (richdocumentscode) Nextcloud app < 26.4.303 (26.4.302 and older)

How to Test: In Nextcloud's Apps page (or via occ app:list) check whether 'Collabora Online - Built-in CODE Server' (richdocumentscode) is installed and whether its version is 26.4.302 or lower; if you only have the richdocuments app pointing at a separate Collabora server (Docker, distro package, or a hosting provider) you are not affected. If you ran a vulnerable version, review web server access logs for unauthenticated requests to the richdocumentscode proxy.php endpoint, especially around times the CODE server was stopped or restarting, and search the Nextcloud web root and data directories for unexpected PHP files or webshells and the web server user for unexpected processes.

How to Patch: Update the Collabora Online - Built-in CODE Server (richdocumentscode) app to 26.4.303 or later from the Nextcloud app store. If you cannot update immediately, remove or disable the richdocumentscode app and point richdocuments at a standalone Collabora Online server instead.

Evidence: VulnCheck KEV · Report of in-the-wild exploitation and webshell discoveries on Nextcloud servers

Full entry with sources →

Read on the web · Every past edition

The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.

Spot an error, or an exploit we missed? Reply here or email [email protected].