Attackers are exploiting a critical command execution vulnerability in the Collabora Online - Built-in CODE Server app, known as richdocumentscode, within the Nextcloud platform. The vulnerability is tracked as CVE-2026-110447, while administrator reports indicate that exploitation began in mid-September, about a month before the official security advisory and CVE identifier were published.
What is happening?
The vulnerability affects richdocumentscode versions older than 26.4.303 and exists in the mechanism that runs the Collabora server embedded in the Nextcloud app. An attacker can send a specially crafted request to the proxy.php endpoint, resulting in the injection and execution of operating system commands.
Exploitation does not require authentication or user interaction, but there is an important condition: the embedded CODE Server must be stopped, as may happen after a server restart or upgrade, or following a failure. Administrators reported that the malicious activity affected multiple endpoints since September 10.
Scope of impact and mitigation measures
The impact is limited to the optional, embedded CODE Server app. According to Collabora, standalone Collabora Online servers, installations via Docker and RPM/DEB, and Nextcloud All-in-One distributions are not affected.
According to administrator reports, the attackers planted PHP-based backdoors and then used them to search for password databases, files associated with password managers, and cryptocurrency wallets. Some users said that ransomware operators were also exploiting the vulnerability, but BleepingComputer was unable to independently confirm this.
Users are advised to update to version 26.4.303 or later, or remove the app if it is not needed. The vendor warns that disabling the app alone is not sufficient remediation. A community group also published a warning on October 3, urging immediate updates because exploitation was continuing.
Why does this matter?
The practical danger lies in the gap between the availability of the fix and the official disclosure. The fix was committed to the repository on September 9, and the fixed version was released on September 11, while the advisory and CVE identifier were published on October 14—a gap of more than four weeks. During this period, it was more difficult for administrators to identify the problem and link it to ongoing attack activity.
Nextcloud said that Collabora notified it of the vulnerability in mid-September and that the update became available through the app store, explaining the delayed disclosure as an effort to give users time to update and because widespread exploitation had not been observed. Collabora attributed the delay primarily to a backlog in processing CVE requests on GitHub, amid an increase in vulnerability reports supported by artificial intelligence tools.
A study cited by the source from cybersecurity company Second Security indicates that the median gap between public fixes and the publication of CVE identifiers reached 39 days in August, compared with 5.1 days in January. The study also found that public exploit code may appear within hours of a fix being released and days before the CVE is published, underscoring the importance of monitoring product updates themselves and not waiting for a CVE number alone before taking defensive action.