1-minute read
What a defender needs to know
Attackers have exploited CVE-2026-110447, a command-injection flaw in Nextcloud’s Collabora Online – Built-in CODE Server app. Its proxy.php can execute a command as the web-server user when the built-in CODE server is stopped, including during a restart, upgrade or crash. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 23 and set an October 26 federal action date. The CVE record dates exploitation to September and October 2026.
Check whether richdocumentscode is installed on your Nextcloud instances and compare its version with first-fixed 26.4.303. Upgrade to that version or later, or remove the app. Collabora says disabling the app leaves the vulnerable copy in place. Standalone Collabora Online servers and Nextcloud deployments without the built-in app fall outside this affected path. For end-of-life Nextcloud 29 and older, the vendor advises upgrading Nextcloud or removing the app.
Check app-integrity results for unexpected PHP files under apps/richdocumentscode/; one community participant reported EXTRA_FILE for ./apps/richdocumentscode/Nx_33143.php. Review web-server access logs for unusual proxy.php requests around CODE server stops. Preserve suspicious artifacts and logs for incident response, and assess credentials readable by the web-server user if you find a web shell. A quiet access log can reflect short log retention; compare preserved integrity findings with the CODE server stop times before restoring a suspect instance to service. Keep the pre-update app version with the integrity result for responders. Verify the installed version or removal after changing the app; investigate the earlier vulnerable period separately.