Summary
- The flaw affects the optional Nextcloud Collabora built-in CODE app, richdocumentscode, through its proxy component.
- An unauthenticated command-injection path can be reachable if the local CODE process is not running and the vulnerable proxy remains accessible.
- Version 26.4.303 fixes the problem; the advisory does not implicate all Nextcloud installations or standalone Collabora Online servers.
Collabora Online has disclosed a critical unauthenticated operating-system command-injection flaw in richdocumentscode, the optional built-in CODE server application for Nextcloud. Exposure depends on the local document service being unavailable while the vulnerable proxy remains reachable.
The 14 October advisory, GHSA-g3vx-3m76-fghh, concerns the application’s proxy component rather than Nextcloud Server as a whole. When the local Collabora Online Development Edition (CODE) process is not running, a request to the affected proxy can reach a command-injection path without prior authentication. Restarts, upgrades, or service failures are possible circumstances, but the public notice does not establish that all such events were exploited.
The fixed richdocumentscode release is 26.4.303, replacing vulnerable earlier versions of the optional application. The advisory does not establish exposure in standalone Collabora Online servers, instances using a separate document server without this app, or Nextcloud installations without richdocumentscode. A core Nextcloud version number alone does not identify the state of this component.
Nextcloud provides a self-hosted collaboration environment for files, projects, and documents. Built-in CODE makes browser-based document editing possible without operating a separate office server. That convenience adds an application component with its own release cycle, operational dependencies, and security boundary. A vulnerability within it cannot necessarily be addressed by updating the core Nextcloud server alone.
The requirement that the local service be unavailable may appear to narrow the attack window, but service restarts and failures are normal operational events. An attacker who can reach the affected proxy route during that state does not need an authenticated user account under the documented conditions. This distinguishes the issue from vulnerabilities that require a legitimate collaborator or administrative privileges.
Command execution on a collaboration host creates potential consequences for document confidentiality, service integrity, and adjacent systems, depending on the permissions granted to the application and the server’s network access. The public advisory establishes the software vulnerability, not a universal outcome for every affected Nextcloud deployment.
Version and application inventory are particularly relevant in self-hosted environments. Some organisations maintain core Nextcloud upgrades through a central platform team while document editing extensions are administered separately. A service can therefore appear current at the platform level even if an installed component has missed a security release.
Earlier Cyber Insider reporting covered other Nextcloud component vulnerabilities identified by French authorities. The new Collabora issue is a separate disclosure with a different technical mechanism and fix. Combining the incidents into a single generic Nextcloud warning would obscure the specific versions and configurations that require attention.
A component update alone does not establish whether an installation was compromised before remediation. Review of proxy access and host records may be appropriate where the vulnerable app was reachable during interruptions to the local CODE service. Those records can also show whether the proxy was accessible when the local service was unavailable, though their absence cannot rule out abuse. The maintainer advisory verifies a critical software issue, but does not provide an independently established total of exploited systems or a reliable geographic breakdown.
Public vulnerability records associate the issue with CVE-2026-110447, but claims that attackers planted web shells in September or October appear in secondary reporting and are not corroborated by the available maintainer statement. They are therefore not treated as confirmed incidents here. The newly published advisory also describes a defect distinct from previously disclosed weaknesses in document collaboration components. Response depends on the installed application version and whether its proxy route was reachable when local CODE was unavailable.
The maintainer’s correction identifies one application release and a specific service-state condition. The number of affected Nextcloud installations, any confirmed exploitation history, and the wider geographic distribution of vulnerable deployments remain unquantified in the primary advisory. Separately operated Collabora servers do not have the same optional Nextcloud proxy configuration.
