Nextcloud Collabora built-in CODE server CVE-2026-110447 (richdocumentscode, actively exploited, in CISA KEV): am I affected and how do I fix it?

Am I affected? Only if your Nextcloud has the optional app 'Collabora Online - Built-in CODE Server' (app id richdocumentscode) installed at a version below 26.4.303. Standalone Collabora Online servers, Docker or RPM/DEB Collabora installs, and Nextcloud All-in-One are not affected. It's an unauthenticated OS command injection (CVSS 9.2). Attacks started in mid-September, about a month before the advisory, and CISA added it to the Known Exploited Vulnerabilities catalog on October 23, 2026. How to check: - sudo -u www-data php occ app:list | grep -A1 richdocumentscode (or Apps > Office & text in the web UI). Fix: - Update the app: sudo -u www-data php occ app:update richdocumentscode, and confirm it reports 26.4.303 or newer. - If you don't need it, remove it: php occ app:remove richdocumentscode. Disabling the app is NOT enough, because its files stay in the web root. - Longer term, a separate Collabora Online server (Docker or packages) is the supported setup for real use. After fixing (assume compromise if the app was exposed since September): - Look for PHP files that shouldn't be there in the Nextcloud apps and custom_apps directories and the data directory, and compare against a clean copy of the release (php occ integrity:check-core and app integrity checks help). - Check for unexpected processes or cron entries running as the web server user. - Rotate secrets the server could read: database password, config.php secrets, SMTP/LDAP credentials, and app passwords. Review admin accounts. Sources: https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0 https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/ https://www.esecurityplanet.com/threats/news-collabora-nextcloud-cve-2026-110447/ https://security-tracker.debian.org/tracker/CVE-2026-110447