Attackers are exploiting an unauthenticated command injection flaw (CVE-2026-110447) in Nextcloud's 'Collabora Online - Built-in CODE Server' app to plant PHP webshells. It affects you if you self-host Nextcloud with that app. Update it today to 26.4.303 or remove it, and look for signs of intrusion going back to 10 September.
Key facts
- CVE-2026-110447 affects all versions of the richdocumentscode app before 26.4.303, according to BleepingComputer. A malicious request to the proxy.php endpoint triggers OS command injection, with no authentication or user interaction.
- It can only be exploited while the built-in CODE server is stopped: after a restart, an update or a crash.
- Timeline: first recorded attack on 10 September; fixed version 26.4.303 on 11 September; advisory and CVE on 14 October; BleepingComputer report on the 15th.
- In reported cases, attackers planted PHP webshells and searched for password databases, password manager artefacts and cryptocurrency wallets. No report shows root access.
- Nobody knows how many servers are compromised. Some users say ransomware operators are also exploiting it, but BleepingComputer could not confirm this.
Does it affect me if I use Nextcloud?
Only if you self-host Nextcloud and have the 'Collabora Online - Built-in CODE Server' app (richdocumentscode) installed. It is the app that lets you edit documents without running a separate Collabora server.
According to The Hacker News, these are not affected:
- Standalone Collabora servers.
- Docker or RPM/DEB installations.
- Nextcloud All-in-One.
- Installations that only use Nextcloud Office (richdocuments) without the built-in app.
Watch out for Nextcloud 29 or earlier, which is end of life. The fixed versions require Nextcloud 30 or later, and the app store still serves a vulnerable version to older installations. Your only options there are to upgrade Nextcloud or remove the app.
If a provider hosts your Nextcloud, you can't check this yourself. You have to ask them.
Why isn't disabling or updating enough?
Disabling the app doesn't help. Collabora is clear: you must update it to 26.4.303 or later, or remove it.
Updating closes the door, but it doesn't remove anyone already inside. Attacks began on 10 September and the formal advisory only arrived on 14 October. Anyone waiting for an advisory before updating was exposed for over a month. And the injected command runs with the web server user's permissions: anything that user can read is potentially exposed.
A note on versions: 26.4.402, released on 24 September, breaks some installations. Several admins have rolled back to 26.4.303, which is the version the advisory names as the fix.
What to do today
- Open Apps in your Nextcloud and check whether 'Collabora Online - Built-in CODE Server' is installed.
- If it is and you need it, update it to 26.4.303 or later. If you don't need it, remove it. Don't just disable it.
- If you run Nextcloud 29 or earlier, upgrade Nextcloud or remove the app.
- Look for shx*.php files inside apps/richdocumentscode and delete them.
- Review access logs from at least 10 September. Look for requests to proxy.php?status containing %2e%2e, $( or ${IFS} in the path.
- If you find signs of intrusion, treat everything the web server user can read (password managers, .kdbx files, keys, credentials) as exposed and rotate it.
- If a provider manages your Nextcloud, ask them in writing to confirm whether they use this app and whether they have checked for signs of compromise.
What it means for an SME
The lesson isn't that Nextcloud is insecure. It's that the affected app describes itself on its own listing as 'for local testing and non-production use', yet it sits on production servers because it's convenient: one click and you get document editing. If you rely on it for real work, the sensible move is a standalone Collabora server, which isn't affected anyway.
Second, the month-long gap between patch and advisory leads to an uncomfortable conclusion: if you only update when a CVE appears, you're late. Nextcloud apps need a regular update routine, not a reactive one.
Third, don't relax just because there's no root access. A webshell with web server permissions can read the files you keep in Nextcloud, and the attackers were going straight for passwords and password managers. If you fall under NIS2 or the GDPR, a confirmed compromise may require you to report the incident. If nobody on your team knows how to review those logs, get outside cybersecurity help before closing the matter.
Frequently asked questions
Is disabling the app enough?
No. Collabora says you must update it to 26.4.303 or later, or remove it.
If I updated in September, am I safe?
Not necessarily. The first recorded attack dates from 10 September, a day before the patch. Look for shx*.php files and review logs from that date.
Is it being used for ransomware?
That isn't confirmed. Some users claim so, but BleepingComputer could not verify it.
