Nextcloud Collabora flaw joins CISA list; 29 and older get no fix

CISA added CVE-2026-110447 to its known exploited vulnerabilities catalog on October 23, with an October 26 deadline for US federal agencies. It lets anyone, without logging in, run commands on a Nextcloud server that has the built-in Collabora office app, richdocumentscode. On Nextcloud 29 or older, no patched build exists.

A restart opens the door

Collabora’s advisory, published October 14, rates the bug critical, 9.2 on CVSS v4. A crafted request to the app’s proxy.php makes the web server run an operating system command as the web server user. It works only while the built-in server is not running, for example after a container restart, an upgrade or a crash. Every version below 26.4.303 is affected.

Two details matter more than the score. Disabling the app does not stop the attack; you have to upgrade or remove it. And standalone Collabora Online servers are not affected. BleepingComputer, citing Collabora, adds that Docker, RPM and DEB installs and Nextcloud All-in-One are safe too.

Attacks ran for a month before the advisory

The fix came first and the warning came late. BleepingComputer reports that the fix was committed on September 9, version 26.4.303 shipped on September 11, and administrators reported attacks from around September 10. On October 3, a user posted on the Nextcloud forum that the flaw “is already being exploited” and that some admins had found web shells. The CVE followed on October 14.

Admins told BleepingComputer the attackers planted PHP web shells and searched for password databases, password manager files and crypto wallets. One forum user wrote on October 16 that Nextcloud’s integrity scan flagged an extra file, Nx_33143.php, in the app’s folder, which they called a simple backdoor. Nextcloud told BleepingComputer it had not seen widespread exploitation. CISA calls its catalog the authoritative list of flaws “exploited in the wild,” so this one now counts.

Nextcloud 29 is stuck on an unpatched build

We checked the Nextcloud app store’s release list and its API on October 24. Version 26.4.303 and every later build require Nextcloud 30 or newer. A server on Nextcloud 29 is offered 26.4.104, released June 7, which is below the fix. The advisory says Nextcloud 29 and earlier are end of life and tells those users to upgrade Nextcloud or remove the app.

So an app update will not save an older server. That is the trap: the store has nothing newer to offer it, and the server stays exposed.

The trade-off is real. Removing the app ends in-browser editing until you set up Collabora some other way, such as the Docker image. Upgrading Nextcloud across major versions takes longer than an app update.

What to do now

1. Check for the app. Run sudo -E -u www-data php occ app:list, per Nextcloud’s occ docs, and look for richdocumentscode. If only richdocuments is there, the forum post says you are not affected.
2. On Nextcloud 30 or newer, run occ app:update richdocumentscode and confirm 26.4.303 or later. The store’s newest build was 26.4.502 on October 23.
3. On Nextcloud 29 or older, run occ app:remove richdocumentscode today, then plan the Nextcloud upgrade.
4. Treat a patched server as possibly compromised. If an old version ran since early September, look for PHP files you did not put in apps/richdocumentscode and change any passwords the web server user could read. CISA’s BOD 26-04 asks agencies for this same step, a “forensic triage of the asset to assess whether the system is compromised.”

Sources

• CISA, Known Exploited Vulnerabilities Catalog, CVE-2026-110447 (added October 23, 2026; read October 24): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Collabora, GHSA-g3vx-3m76-fghh, “Unauthenticated OS command injection in the richdocumentscode proxy,” October 14, 2026: https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh
• BleepingComputer (Bill Toulas), “Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers,” October 15, 2026: https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/
• Nextcloud community forum, “To Collabora Built-in User: Update ASAP,” October 3, 2026: https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516
• Nextcloud App Store, richdocumentscode releases (read October 24, 2026): https://apps.nextcloud.com/apps/richdocumentscode/releases
• Nextcloud admin manual, occ app commands: https://docs.nextcloud.com/server/latest/admin_manual/occ_apps.html
• CISA, BOD 26-04, Prioritizing Security Updates Based on Risk: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk