CSIRT Bolivia warns on CVE-2026-110447 in Nextcloud

Bolivia’s CSIRT has issued an alert for CVE-2026-110447, a critical command injection flaw in Collabora Online Built-in CODE Server for Nextcloud, tied to the richdocumentscode app. It affects versions earlier than 26.4.303 and, according to the notice, could allow command execution through a manipulated HTTP request to proxy.php when the CODE server is not running.

Who is affected by the flaw?

The vulnerability affects only Nextcloud’s Collabora Online, Built-in CODE Server app, also identified as richdocumentscode, according to Collabora’s official notice. The same statement says standalone Collabora Online installations are not affected by this issue.

That scope matters for organizations using Nextcloud with the built-in CODE server, especially if those instances are exposed to the internet, as Bolivia’s CSIRT noted in its warning. The material does not name affected sectors or environments, but it does define which deployments are inside and outside the risk window.

What does Collabora say about the fix?

Collabora said disabling the app is not enough to remediate the flaw. According to its notice, the right step is to update to version 26.4.303 or later, or remove the application.

The CVE record adds another key detail. The vulnerability is said to have been actively exploited during September and October 2026, and the vulnerable scenario appears when the CODE server is not running, for example after a reboot.

What technical details emerged?

A technical analysis published by dbugs said that proxy.php wraps request text into a Bash command inside double quotes. According to that report, this would let an attacker insert a $(...) sequence into the path and run commands without authentication.

The same analysis said PHP web shells and sensitive file theft were observed. That part is attributed to dbugs’ technical work, which describes the behavior seen during exploitation.

There was also press coverage pointing to ongoing exploitation. BleepingComputer reported that actors were using the flaw to compromise Nextcloud servers, and cited Collabora in noting that Nextcloud All-in-One, Docker or RPM/DEB installs, and standalone Collabora servers are not affected. SC Media said Collabora fixed the vulnerability on September 11 with version 26.4.303 and published the notice on October 14, and reiterated that disabling the app is not a sufficient mitigation.