Collabora Online App Vulnerability Fixed
Administrators must update the richdocumentscode app to version 26.4.303 to prevent command injection exploits.
Updated on Oct. 20, 2026 in Cybersecurity
Live Poll
Do you trust that the online services you use are effectively protecting your personal data?
Hackers have been exploiting a command-injection vulnerability in the Collabora Online Built-in CODE Server app since September 10, 2026. The flaw allows unauthorized actors to execute system commands with web server privileges by placing PHP web shells into the app directory.
Why it matters
The vulnerability poses a severe security risk, as unauthenticated attackers can leverage web server account privileges to gain control over affected systems. Administrators must update the richdocumentscode app to version 26.4.303 or remove it entirely to mitigate the ongoing threat.
The flaw, tracked as CVE-2026-110447, permits command injection when the local document server is offline, crashing, or updating. Standalone Collabora Online servers are not impacted by this specific security issue.
The players
Collabora Online
This organization provides the Built-in CODE Server app used to integrate document editing capabilities into platforms like Nextcloud.
Nextcloud
This is a suite of client-server software for creating and using file hosting services where the vulnerable app was deployed.
The details
Exploitation occurs when the local CODE server is down or transitioning, providing an opening for attackers to drop PHP web shells within the apps/richdocumentscode/ directory. While fixed version 26.4.303 addresses the flaw, those using end-of-life version 29 of Nextcloud should verify their environment status.
Timeline
September 10, 2026: Earliest observed date of exploitation.
September 11, 2026: Release of fixed version 26.4.303.
October 14, 2026: Publication of the security advisory.
The Tech Race
The vulnerability tracked as CVE-2026-110447 highlights the ongoing risks associated with integrated server applications in private cloud environments. It underscores the importance of rapid patch management for third-party plugins that operate with elevated web server privileges.
Users managing these servers must perform the software update to protect their hosted data from potential unauthorized access. Failure to update or remove the vulnerable component leaves the server's directory accessible to command-injection attacks.
The takeaway
Security vulnerabilities in integrated applications often rely on server downtime or instability to bypass existing defenses. Administrators should prioritize regular monitoring and immediate patching of all third-party app dependencies.
Further reading
For more information on securing private cloud deployments, visit the Cybersecurity section.
Source note: This article includes information reported by ESecurityPlanet.
Live Poll
Do you trust that the online services you use are effectively protecting your personal data?
