CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Collabora Online Built-in CODE Server

product · product:collabora-online-built-in-code-server

Coverage
1
first 2026-10-15 → last 2026-10-15
Latest activity
2026-10-15
Exploited Nextcloud Collabora CODE app flaw: disabling the app does not help; update to 26.4.303 or remove it
Peak priority
high
1 high
Targets
technology
sectors: technology
Sources cited
4
2 hosts

Action items (2)

Do-now tasks recorded on the entries about Collabora Online Built-in CODE Server, newest first. Check the date before acting on an older one.

  • Update the Collabora Online Built-in CODE Server app (richdocumentscode) to 26.4.303 or remove it on every Nextcloud server that runs it; disabling the app does not stop the request, and on Nextcloud 29 or older, which is end of life, upgrade Nextcloud or remove the app.
    2026-10-15CVE-2026-110447
  • On each such server, search the web access logs back to at least early September 2026 for requests to apps/richdocumentscode/proxy.php that carry $( or an encoded .. in the path, and the app directory for PHP files that are not part of the release; on a hit, treat every secret the web server account can read as exposed and rotate it.
    2026-10-15CVE-2026-110447

Defender insights

What each entry about Collabora Online Built-in CODE Server tells a defender to do, newest first.

2026-10-15HIGHexploitedExploited Nextcloud Collabora CODE app flaw: disabling the app does not help; update to 26.4.303 or remove it

Exposure · detection

Story timeline

  1. 2026-10-15CVE-2026-110447, Collabora Online Built-in CODE Server (Nextcloud richdocumentscode app): an unauthenticated command injection in proxy.php, exploited in the wild to plant PHP web shells, fixed in 26.4.303 (CVSS 4.0 9.2)
    trending-vulnerabilitiesExploited Nextcloud Collabora CODE app flaw: disabling the app does not help; update to 26.4.303 or remove it

Hunting pivots

CVEs (exploited first)
CVE-2026-110447
Releases covered
Collabora Online Built-in CODE Server
Tags
actively-exploitedpatch-availablepre-authrcevulnerabilitieszero-click
ATT&CK techniques (4 across 4 tactics)

4 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionCommand and Scripting Interpreter: Unix Shell
  • PersistenceServer Software Component: Web Shell
  • DiscoveryFile and Directory Discovery

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-15/cve-2026-110447-collabora-code-server-nextcloud-rce · ATT&CK page ↗

Execution TA0002

T1059.004Command and Scripting Interpreter: Unix Shell×1

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Evidence: 2026-10-15/cve-2026-110447-collabora-code-server-nextcloud-rce · ATT&CK page ↗

Persistence TA0003

T1505.003Server Software Component: Web Shell×1

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.

Evidence: 2026-10-15/cve-2026-110447-collabora-code-server-nextcloud-rce · ATT&CK page ↗

Discovery TA0007

T1083File and Directory Discovery×1

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Evidence: 2026-10-15/cve-2026-110447-collabora-code-server-nextcloud-rce · ATT&CK page ↗

Entries about Collabora Online Built-in CODE Server (1)

2026-10-15 · view entry permalink →

HIGHCVE-2026-110447exploitedNATOA2

CVE-2026-110447, Collabora Online Built-in CODE Server (Nextcloud richdocumentscode app): an unauthenticated command injection in proxy.php, exploited in the wild to plant PHP web shells, fixed in 26.4.303 (CVSS 4.0 9.2)

Collabora's own advisory, published 2026-10-14, says users of Nextcloud with the Collabora Online Built-in CODE Server app (richdocumentscode) can be vulnerable through proxy.php: a request can run an operating system command as the web server user, the attack works only while the built-in CODE server is not running (after a restart, an upgrade or a crash), and disabling the app is not sufficient, it must be upgraded to 26.4.303 or later or removed (Collabora Online security advisory, 2026-10-14). Users of end-of-life Nextcloud 29 or older should upgrade Nextcloud or remove the app, standalone Collabora Online servers are not affected, and the fix for CVE-2025-66208 does not prevent this flaw (Collabora Online security advisory, 2026-10-14). The GitHub Advisory Database record for CVE-2026-110447 says it was exploited in the wild in September and October 2026 (GitHub Advisory Database, 2026-10-14). Field reports came first: on 2026-09-11 a hoster reported on the app's issue tracker that several Nextcloud servers running richdocumentscode 26.4.302 had been compromised since the previous day through requests to proxy.php that carried shell command substitution and an encoded path traversal, with base64 payloads decoded and run through a shell to create PHP web shells in the app directory; on one server the attacker then searched for password-manager databases and cryptocurrency-wallet files, and the reviewed requests showed no archiving or upload commands (issue 354, 2026-09-11). Other administrators report the same compromise, one noticing it because Nextcloud's integrity check failed on an unexpected PHP file (issue 354, 2026-09-11). A reply on the issue says the flaw affects only the Development Edition in the Built-in CODE Server mode that downloads a local AppImage, and a later one that leftover web-shell files must be removed after upgrading (issue 354, 2026-09-11). A Nextcloud forum post of 2026-10-03 told users to update, saying that as far as the poster knew no CVE existed (Nextcloud community forum, 2026-10-03).

It is not sufficient to disable the app to avoid the problem, it must be upgraded to >= 26.4.303 or removed.

Collabora Online security advisory 2026-10-14

as exploited in the wild in September and October 2026

GitHub Advisory Database 2026-10-14

The attacker was able to create php-files which are web-shells:

CollaboraOnline/richdocumentscode issue 354 2026-09-11

This impacts only the Development Edition, and only in this (rather rarer) Built-in CODE Server deployment mode that downloads a local appimage.

CollaboraOnline/richdocumentscode issue 354 (a reply on the issue)
vulnerability15 Oct 03:42Zmulti-sourceOpen finding →
Sources: Collabora Online security advisory · GitHub Advisory Database · CollaboraOnline/richdocumentscode issue 354 · Nextcloud community forum

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • github.com3 (75%)
  • help.nextcloud.com1 (25%)
All cited sources (4)