A critical flaw in the Collabora Online Built-in CODE Server app for Nextcloud is being actively exploited. Tracked as CVE-2026-110447, the operating-system command injection bug lets attackers with no login run commands on the server and plant PHP web shells that keep them in after the first break-in. Collabora disclosed the vulnerability on October 14, 2026, but administrators were already finding web shells on their servers weeks earlier. If you run Nextcloud with the Built-in CODE Server app installed, the fix is to upgrade the richdocumentscode app to version 26.4.303 or remove it entirely. Simply disabling the app does not stop the attack.
What happened
On October 14, 2026, Collabora published a security advisory for CVE-2026-110447, a critical unauthenticated OS command injection in the richdocumentscode app, also known as the Collabora Online Built-in CODE Server. The flaw carries a CVSS v4 score of 9.2. The GitHub Advisory Database entry states that attackers exploited the bug during September and October 2026, and a warning posted to the Nextcloud community forum on October 3 reported that users had already found web shells sitting on their servers. Collabora released the fixed version, 26.4.303, on September 11, 2026, which means servers that fell behind on updates were exposed through a known, actively exploited entry point for more than a month.
This is not the first time this app has drawn scrutiny. Collabora notes that CVE-2026-110447 uses a different attack path than the earlier CVE-2025-66208, and fixing that older flaw does not protect against this one.
What the Collabora Online Built-in CODE Server is
The Built-in CODE Server is an optional Nextcloud app that runs Collabora Online directly on the Nextcloud server itself. With it installed, users can open and edit office documents in the browser without a separate Collabora server. That convenience comes with a cost: the app runs an additional document server process inside the Nextcloud environment, and proxy.php, the component that contains the flaw, is the piece that forwards requests to it.
Standalone Collabora Online servers are not affected. The risk is limited to Nextcloud installations that use the Built-in CODE Server app, specifically versions of richdocumentscode before 26.4.303.
How the attack works
The vulnerability sits in proxy.php. When the built-in CODE server is not running, a crafted request to that file can cause the server to execute an operating-system command with the permissions of the web server user. It is classified as CWE-78, operating system command injection, and it needs no account and no click from anyone. An unauthenticated attacker on the internet can simply send the request.
The condition that matters is that the CODE server process must be stopped when the malicious request arrives. That happens during ordinary maintenance: a container restart, an upgrade, or a crash. So the attack window opens during the exact moments administrators usually associate with safety, right after restarting a service. Once the window is open, encoded path traversal and shell command substitution in the request do the rest.
The commands run as the web server user, not automatically as root, but the GitHub advisory rates the impact on data privacy, file integrity, and service availability as high. From there, the attacker drops a PHP web shell into the app directory. Community reports describe small files named like shx*.php, which give the attacker a persistent way to run commands again later, long after the first request.
Who is affected
Any internet-facing Nextcloud server running richdocumentscode before version 26.4.303 is in scope. The critical nuance, from Collabora’s own advisory, is that disabling the app is not enough. The app must be upgraded to 26.4.303 or later, or removed completely. Servers that have been reachable from the internet since at least early September 2026 should be treated as potentially compromised regardless of their current patch state.
There is a second wrinkle for older installations. The fixed release requires Nextcloud 30 or later. Administrators still running Nextcloud 29 or earlier, which are end of life, cannot take the fixed app version without also upgrading the platform, so Collabora’s guidance for them is to upgrade Nextcloud or remove the app.
What attackers do once they are in
According to administrator reports in the richdocumentscode issue tracker, the pattern has been consistent across multiple independent Nextcloud installations. Crafted GET requests hit /apps/richdocumentscode/proxy.php?status with encoded path traversal, and PHP web shells land in the app directory. On one compromised server, the attacker ran commands searching for credential and cryptocurrency wallet files, suggesting the goal was to harvest anything valuable stored on the machine before moving on.
The reports do not identify a specific threat group and do not say how many servers were breached. What is clear is that this is opportunistic, scan-driven exploitation of a public app endpoint, the kind of thing that runs continuously once a working exploit is in circulation. As of October 16, 2026, CVE-2026-110447 was not yet listed in the CISA Known Exploited Vulnerabilities catalog, but the in-the-wild exploitation is confirmed by both the GitHub Advisory Database and affected administrators.
This is part of a wider pattern of attackers targeting the tools that sit next to the actual workload. Recent TechToRev coverage of the Rank Math SEO PRO supply-chain compromise showed how a tainted plugin update can become a fleet-wide foothold, and the Tensorlake npm compromise showed how a poisoned package spreads through developer machines. The Collabora case is the same idea aimed at self-hosted file infrastructure instead.
What to do right now
If you administer a Nextcloud server, treat this as urgent. Patching alone is not the whole job, because a patch does not remove web shells an attacker may already have planted. Work through the following steps in order.
- Upgrade or remove the app. Update richdocumentscode to 26.4.303 or later, or remove the app entirely. Disabling it is not sufficient. On Nextcloud 29 or earlier, upgrade the platform or remove the app.
- Look for the known indicators. Check the richdocumentscode app directory for unfamiliar PHP files, especially files matching shx*.php. Review web server access logs for requests to /apps/richdocumentscode/proxy.php containing encoded traversal sequences, and run Nextcloud’s integrity check, which has flagged rogue files on compromised hosts.
- Assume breach if exposed. If your server was internet-accessible with the vulnerable app any time since early September 2026, investigate as if it was compromised, even after patching. The web shell provides persistence independent of the original bug.
- Rotate secrets. Attackers on at least one server went looking for password databases and crypto wallets. Assume credentials, tokens, and keys stored on or reachable from the host may have been read, and rotate them.
- Watch the catalog. The flaw is not yet in CISA’s KEV catalog, but given confirmed active exploitation, treat the federal 21-day patch discipline as a good yardstick for your own remediation deadline.
WordPress administrators will recognize the muscle memory here: the recent Backuply SQL injection flaw and the Bricksforge RCE bug both rewarded the same habits, patch fast and check for signs the patch arrived too late.
Frequently asked questions
Does CVE-2026-110447 affect every Nextcloud server?
No. Only servers running the Collabora Online Built-in CODE Server app (richdocumentscode) before version 26.4.303 are affected. Nextcloud deployments using a standalone Collabora server or other document-server setups are not automatically at risk, and standalone Collabora Online servers are explicitly not affected.
Is the vulnerability being exploited right now?
Yes. The GitHub Advisory Database confirms exploitation in the wild during September and October 2026. The first malicious request seen by one administrator was on September 16, and users were reporting web shells on the Nextcloud community forum by October 3.
Can I just disable the app to stay safe?
No. Collabora states that disabling the app is not sufficient. You must upgrade richdocumentscode to 26.4.303 or later, or remove the app completely.
Does patching remove a web shell the attacker already planted?
No. Updating closes the entry point but does not remove persistence. After patching, search the app directory for unexpected PHP files such as shx*.php, check access logs for traversal requests to proxy.php, and treat an exposed server as possibly compromised until you have verified it is clean.
How is this different from the earlier Collabora flaw CVE-2025-66208?
Collabora says CVE-2026-110447 uses a different attack path, so applying the fix for the older vulnerability does not block this exploit. Each flaw needs its own remediation.