CVE-2026-110447: Collabora CODE Server Exploited

CVE-2026-110447 is a CVSS 9.8 command injection in the Built-in CODE Server component of Collabora Online (the richdocumentscode Nextcloud app), actively exploited since at least September 2026. Patch to version 26.4.303 now.

What’s happening

Multiple independent Nextcloud installations running richdocumentscode before 26.4.303 have been compromised. Threat actors used the flaw to gain persistent access, then searched hosted file stores for high-value targets: cryptocurrency wallet data, password manager exports, and credential files. The targeting pattern is financial, not opportunistic.

The GitHub security advisory GHSA-g3vx-3m76-fghh documents this as a distinct vulnerability from an earlier Collabora flaw. If you patched a previous Collabora issue, this one still needs attention.

What to do

Update richdocumentscode to 26.4.303 or later via the Nextcloud app store or your server package manager. If you cannot patch immediately, disable the Built-in CODE Server and switch to an external Collabora Online Server instance until you can.

After patching, review your Nextcloud file activity logs for bulk access to wallet files, .kdbx files, or credential exports. Compromised instances showed this pattern before the webshells were discovered.

Priority call

Patch this first. CVSS 9.8, confirmed active exploitation, and specific credential-theft targeting. The update is a straightforward app-store install.

Related: Critical Ghostscript Flaw Lets PDFs Execute Code, AhsayCBS Backup Platform Exploited, No Patch Ready, Docker Hub Fixes Critical Image Impersonation Flaw