AI analysis
Claude Opus · 5 Nov 2026, 10:20 CET
Nextcloud's Collabora built-in CODE server exposed to exploited command injection
Versions of the Collabora Online Built-in CODE Server Nextcloud app (richdocumentscode) before 26.4.303 allow unauthenticated remote code execution. Exploitation is confirmed and the flaw is in CISA KEV. Update immediately and check for compromise.
In plain terms
Nextcloud is a widely used self-hosted file sharing and collaboration platform. Many installations add document editing through an app called Collabora Online Built-in CODE Server (package name richdocumentscode), which runs an office suite inside the Nextcloud server. A flaw in this app lets an attacker on the internet run their own operating system commands on the server without logging in. This is called command injection: untrusted input ends up inside a system command.
The weakness can be triggered when the built-in document server is not running, for example shortly after a restart. Exploitation has been seen in practice in September and October 2026. Anyone running Nextcloud with this built-in app below version 26.4.303 should act now. Standalone Collabora Online servers are not affected.