Nextcloud built-in CODE server: exploited command injection, CVE-2026-110447

What happened

The Collabora Online – Built-in CODE Server, the Nextcloud app that ships an embedded Collabora Online document server, contains an OS command injection vulnerability tracked as CVE-2026-110447. According to the source data, it allows remote code execution when the CODE server isn't running. The vulnerability has a CVSS base score of 9.8.

The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, which means it is being actively exploited. On the Nextcloud community forum, the Collabora team has asked users of the built-in server to update as soon as possible.

Who is affected

You are affected if you run Nextcloud with the "Collabora Online – Built-in CODE Server" app (app ID richdocumentscode) installed. Installations that connect Nextcloud to a separately installed Collabora Online or CODE server are not described as affected in the source data.

The affected and fixed versions are not stated in the data we have. Check the Collabora security advisory (GHSA-g3vx-3m76-fghh) and the Nextcloud forum post linked below for the exact versions.

If you host Nextcloud for customers, check every instance, including ones where the app was installed once for testing and then forgotten.

What to do now

1. Find out whether the app is installed: run sudo -u www-data php occ app:list | grep -i richdocumentscode in your Nextcloud directory (adjust the web server user to your system).
2. Back up your Nextcloud configuration (config/config.php) before making changes.
3. Update the app to the fixed version named in the vendor advisory, either through Apps in the Nextcloud admin interface or with sudo -u www-data php occ app:update richdocumentscode.
4. If you do not use the built-in document server, or cannot update right away, disable it: sudo -u www-data php occ app:disable richdocumentscode. Consider removing it entirely.
5. Confirm that document editing still works if you rely on it, and that Nextcloud itself is reachable and healthy (occ status).
6. Because the vulnerability is actively exploited, check the server for signs of compromise (see below), especially if the instance is reachable from the internet and was running a vulnerable version.

How to check whether you are affected

• Run occ app:list and compare the installed version of richdocumentscode with the fixed version in the vendor advisory.
• Look for unexpected processes running as the web server user (for example with ps -u www-data -f), unfamiliar cron jobs, and recently modified or newly created files in the Nextcloud directory and in temporary directories.
• Review web server access logs and the Nextcloud log (data/nextcloud.log) for unusual requests to the richdocumentscode app paths and unexpected errors.
• Check for unexpected outbound network connections from the server.

If you find signs of compromise, isolate the server, preserve the logs and treat credentials stored on or accessible from the server as exposed.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-110447
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog