Collabora Online CODE Server RCE via proxy endpoint
Critical command injection in Collabora Online's Built-in CODE Server before 26.4.303, exploited to plant webshells on Nextcloud instances since September 2026.
- Vendor
- CollaboraOnline
- Product
- Collabora Online Built-in CODE Server (richdocumentscode)
- CVSS
- 9.8
- EPSS (exploit probability)
- 1.2%
- Status
- exploited-in-wild
- Published
CVE-2026-110447 is a critical command injection in the Built-in CODE Server component bundled as the richdocumentscode Nextcloud app. All versions before 26.4.303 are affected.
Active exploitation has been confirmed since at least September 2026. Attackers gained persistent access to vulnerable Nextcloud instances, then systematically searched stored files for cryptocurrency wallet data, password manager exports, and credential stores. The targeting pattern is financially motivated.
This is a separate vulnerability from an earlier Collabora flaw. Patching a prior Collabora issue does not protect against CVE-2026-110447.
Patch to richdocumentscode version 26.4.303 or later via the Nextcloud app store or your server package manager. If immediate patching is not possible, disable the Built-in CODE Server and migrate to an external Collabora Online Server instance.
Sources: NVD | GitHub Advisory GHSA-g3vx-3m76-fghh
