If you run Nextcloud with the Collabora Online Built-in CODE Server app installed, update it to version 26.4.303 or later, or remove it completely. That is the direct answer to CVE-2026-110447, a critical command injection flaw that attackers have already used to plant web shells on Nextcloud servers. Disabling the app does not fix the problem, and waiting is risky because the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog on October 23, 2026, with a patch deadline of October 26, 2026 for federal civilian agencies.
The flaw is easy to miss. It lives in a helper app many small teams install once and then forget, it only becomes exploitable when a local document server stops, and the fix itself shipped weeks before anyone labelled it a security update. This article explains what happened, who is actually at risk, how the attack works in plain terms, and exactly what to check on your own server.
What happened with CVE-2026-110447
CVE-2026-110447 is an operating system command injection vulnerability in the Collabora Online Built-in CODE Server app for Nextcloud, known by the package name richdocumentscode. It carries a CVSS v4.0 score of 9.2, which puts it in the critical range. An attacker needs no login and no interaction from a user to trigger it.
Timeline:
- September 10, 2026: the earliest logged attack reported by administrators.
- September 11, 2026: Collabora released version 26.4.303, which contains the fix, but without a security note drawing attention to it at the time.
- October 14, 2026: Collabora published its security advisory and the CVE identifier, warning that disabling the app is not enough.
- October 23, 2026: CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog, alongside the Arista VeloCloud flaw covered in our earlier report.
- October 26, 2026: the remediation deadline CISA set for federal civilian agencies.
That gap between the September fix and the October advisory is the core risk. An administrator who updated in September is likely safe. An administrator who saw no urgent security warning and postponed the update is exactly who attackers have been finding since September.
Who is affected, and who is not
You are affected only if your Nextcloud installation has the Built-in CODE Server app installed at a version before 26.4.303. That app downloads a copy of Collabora Online Development Edition, known as CODE, and runs it on the Nextcloud server itself, so documents can be edited in the browser without a separate Collabora server.
You are not affected if:
- You run a standalone Collabora Online server, whether in Docker, from a Linux package, or through a hosting provider. Collabora states clearly that standalone servers are not affected.
- You use only the Nextcloud Office app, richdocuments, without the built-in app, and connect it to a separate Collabora server.
- You already run richdocumentscode version 26.4.303 or later.
There is one important exception to check. The fixed version requires Nextcloud 30 or later. Nextcloud 29 and older are end of life, and the app store still serves those versions an affected release. If you are on Nextcloud 29 or older, updating the app alone will not get you to a fixed version. You need to upgrade Nextcloud itself, or remove the built-in app entirely.
The app store listing describes the built-in app as intended for local testing and non-production use, and for personal use or small teams. In practice, many small teams use it in production because it is the simplest way to get document editing working. That mismatch between intended use and real use is part of why this flaw reaches so many servers. Security researchers at Censys reported finding the app installed on tens of thousands of web properties, which gives a sense of the exposed footprint even though not every installation runs a vulnerable version.
How the attack works, in plain terms
The vulnerable component is a small script called proxy.php, inside the apps/richdocumentscode folder. When a request arrives and no local CODE server is listening, proxy.php tries to start one. To do that, it builds a shell command that includes text taken from the incoming request, including the request path.
In versions up to 26.4.302, that text was placed inside a double-quoted Bash command. Bash still expands command substitution, written as dollar-parentheses, inside double quotes. So a crafted request path containing a hidden command was executed by the server as a command, with the privileges of the web server user. No password, no account, and no click from a legitimate user was needed.
The catch, and it is a catch that helps attackers rather than defenders, is timing. The attack only works while the built-in CODE server is not running. That happens more often than people expect: after a container restart, a server reboot, an upgrade, or a crash. An attacker who probes at the right moment, or who simply retries, can hit a window when the server is down and the vulnerable script is ready to start it.
This is also why disabling the app does not help. The web server executes proxy.php directly from the app folder, without loading Nextcloud’s app framework. Turning the app off in Nextcloud’s interface does not stop the web server from running that file if it is still present on disk. Collabora’s advisory is blunt on this point: the app must be upgraded to 26.4.303 or later, or removed.
Note that this is a different flaw from CVE-2025-66208, an earlier command injection in the same script that was fixed in a previous release. Having that older patch does not protect you from CVE-2026-110447.
What attackers did after getting in
Once attackers could run commands as the web server user, reports describe them planting PHP web shells on Nextcloud servers. A web shell is a small file that lets an attacker run commands remotely through the web server, giving them a persistent way back in even after the original flaw is patched.
From there, attackers searched for credential stores, password manager artifacts, configuration files, and cryptocurrency wallets. Anything the web server account could read should be treated as potentially exposed. That includes the Nextcloud database password if it is stored in a configuration file readable by that account, along with any other secrets on the same server.
This pattern is familiar from other recent CISA additions. In our coverage of Plex2Shell, CISA ordered patches for actively exploited Plex flaws, and in the Arista VeloCloud case added to the catalog the same day as Collabora, the lesson was the same: patching stops new attacks, but it does not clean up an attack that already happened. You have to look for it.
What to do right now
Work through these steps in order. Do not stop at step one if you have any reason to think the server was exposed before the patch.
1. Find out if the app is installed
In Nextcloud, open the Apps list and search for Collabora Online Built-in CODE Server. If it is not installed, you are not affected by this flaw, and you can stop here. If it is installed, note the version number.
2. Update to 26.4.303 or later, or remove the app
Update the app to version 26.4.303 or later. If you run Nextcloud 29 or older and cannot install the fixed version, upgrade Nextcloud to a supported release, or remove the built-in app entirely. Removing means deleting the app from disk, not just disabling it in the interface.
If you do not need built-in document editing, removing the app is the safest option. You can still use Nextcloud Office with a separate Collabora server later if you need it.
3. Restart and confirm the fix is active
After updating or removing, confirm the app version in the Apps list, and confirm that no old copy of the app folder remains on disk. A leftover folder with the vulnerable proxy.php file is still a risk, even if the interface shows the app as disabled.
4. Hunt for web shells
Look for unexpected PHP files in the app folder, starting in apps/richdocumentscode. Reports specifically mention files beginning with shx, such as shx followed by random characters and a .php extension. If you find a suspicious file, save a copy for investigation before deleting it, and treat the server as compromised until you have completed the next step.
5. Rotate secrets the web server could read
If you find a web shell, or if your server ran a vulnerable version while exposed to the internet between September and October, rotate the passwords and keys the web server account could read. That includes the Nextcloud database password, any application secrets stored in configuration files, and credentials for connected services. Review web server logs back to at least September 10, 2026 for unusual requests to proxy.php.
For a small team, this is the step most often skipped, and it is the one that matters most after a confirmed compromise. Patching a server that still holds stolen credentials leaves the attacker a way back in through a legitimate login.
Why this flaw slipped past so many admins
Three factors combined here. First, the fix shipped quietly in September, so there was no urgent signal to update. Second, the vulnerable app is often installed as a convenience, not tracked as a critical component, so it does not appear in the same patching routine as the operating system or Nextcloud core. Third, the exploitation condition is intermittent, which makes it easy to assume a server is safe because it has not shown symptoms.
The broader lesson applies well beyond Nextcloud. Bundled helper apps, local testing tools, and built-in servers expand the attack surface even when the main application is patched. If a tool is installed, it needs to be patched or removed, whether or not it is actively used. The same urgency drove the response to PHP2Shell, where emergency patches had to reach servers that had run vulnerable code for years. Inventory first, then patch, then check for prior compromise.
Frequently asked questions
Is my Nextcloud server affected if I never use Collabora?
Only if the Built-in CODE Server app is installed. Simply having Nextcloud, or using Nextcloud Office with a separate Collabora server, does not make you vulnerable. Check the Apps list for the built-in app specifically, and check the version if it is present.
Does disabling the Collabora app protect my server?
No. Collabora states that disabling is not sufficient, because the web server can still execute proxy.php directly. You must upgrade the app to 26.4.303 or later, or remove it from disk completely.
Which version fixes CVE-2026-110447?
Version 26.4.303 of the richdocumentscode app, released on September 11, 2026. Later versions also include the fix. The fixed version requires Nextcloud 30 or later, so older Nextcloud installations need an upgrade or app removal instead.
Is standalone Collabora Online affected?
No. Standalone Collabora Online servers are not affected. The flaw is specific to the Built-in CODE Server app inside Nextcloud.
How do I know if attackers already compromised my server?
Look for unexpected PHP files in apps/richdocumentscode, especially files starting with shx, review web server logs for suspicious requests to proxy.php going back to September 10, 2026, and check for unfamiliar processes, scheduled tasks, or outbound connections. If you find a web shell, preserve a copy, remove it, rotate exposed secrets, and consider a full rebuild if you cannot establish the full scope of access.
What is the deadline for patching?
CISA set October 26, 2026 as the remediation deadline for federal civilian agencies under its binding operational directive. That deadline does not legally apply to private users, but it is a strong signal of how urgently the flaw should be treated, given confirmed exploitation in September and October 2026.
The bottom line is simple. If the built-in app is on your server, update it or delete it today, then check whether anything was left behind. A quiet fix in September does not help a server that stayed on the vulnerable version into October, and a patch applied now does not undo a web shell planted last month.