Nextcloud CVE-2026-110447: Patch the CODE Server Now

CVE-2026-110447 is an unauthenticated OS command injection flaw in the built-in Collabora CODE Server app that ships with Nextcloud Server. Attackers have been exploiting it since on or around September 10, 2026, to plant PHP web shells on vulnerable installations, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog on October 23, 2026. If you run Nextcloud with the optional "Collabora Online — Built-in CODE Server" app (richdocumentscode), you need to update to version 26.4.303 or later immediately — and then go hunting for leftover malware, because patching alone will not remove a web shell an attacker already dropped.

What is CVE-2026-110447?

CVE-2026-110447 is a command-injection vulnerability in proxy.php, a script belonging to richdocumentscode — the Nextcloud app that bundles a local copy of Collabora Online's "CODE" server (Collabora Online Development Edition) so that Nextcloud Office documents can be edited in the browser without standing up a separate Collabora server. According to the GitHub Security Advisory GHSA-f97p-r72q-64h2 and the NVD entry for CVE-2026-110447, the flaw lets an unauthenticated remote attacker execute arbitrary operating-system commands under the privileges of the web server account whenever the bundled CODE server process isn't currently running — for example right after a reboot, an app update, or a crash.

proxy.php is the script that notices the local Collabora process is down and starts it back up. To do that, it builds a shell command using data that comes from the incoming HTTP request. Before the fix, that data wasn't sanitized, so a specially crafted request to /apps/richdocumentscode/proxy.php?status could smuggle in shell metacharacters and have them executed as part of that startup command — no login, no session cookie, no user interaction required.

The bug is rated Critical. NVD lists a primary CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), while the GitHub Advisory Database scores it under CVSS 4.0 at 9.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). The two scoring systems weigh attack requirements differently, which is why secondary write-ups quote slightly different numbers — both place it at the top of the severity scale.

Who is affected?

This is a narrow but nasty blast radius. The flaw only exists in the optional built-in CODE server app that some Nextcloud Server admins install so they don't have to run a separate Collabora Online instance. Per Collabora's own guidance, quoted in the Nextcloud community advisory thread, "To Collabora Built-in User: Update ASAP", the following are not affected:

• Standalone Collabora Online / CODE servers run as their own service
• Collabora installed via Docker, RPM, or DEB packages
• Nextcloud All-in-One (AIO) deployments
• Sites using only the richdocuments connector app without richdocumentscode installed, or using a third-party Collabora hosting provider

You are potentially affected if your Nextcloud instance has the app literally named "Collabora Online — Built-in CODE Server" (package richdocumentscode) enabled, and it was on version 26.4.302 or earlier before you read this.

How the attack works

Because proxy.php only tries to (re)launch the local CODE server when it detects that no instance is currently listening, the window of exploitability opens and closes depending on server state — which is one reason the bug went unnoticed for so long. According to the detailed report thread on the CollaboraOnline/richdocumentscode issue tracker, where an administrator first disclosed active attacks on September 11, 2026, observed exploitation requests hit proxy.php?status and combined several obfuscation techniques in the same payload: directory-traversal sequences (%2e%2e), shell command substitution ($(...)), environment-variable-based space obfuscation (${IFS}), and base64-encoded commands piped to sh. Once a command executes, attackers drop a small PHP web shell — a one-liner that runs shell_exec() against a request parameter — directly into the apps/richdocumentscode/ directory.

From there, reports in that same thread describe attackers using the planted shell to search the filesystem for sensitive material the web server account could read: password-manager database files (*.kdbx), browser or OS credential stores, and cryptocurrency wallet files (such as wallet.dat or keystore.json). The attacks resemble opportunistic, automated post-exploitation reconnaissance more than a single campaign, and multiple independent administrators reported the same pattern within days of each other in mid-September.

This kind of "wait for the service to restart, then race it" bug is conceptually similar to other unauthenticated command-injection flaws that have landed on CISA's KEV list this year, such as the GitLab RCE flaw CVE-2026-97229 — another case where attackers moved from disclosure to active, automated exploitation in a matter of days.

Timeline: patch, disclosure, and KEV listing

One of the more unusual aspects of this case is how far apart the private fix and the public disclosure were — a gap that let attacks run for roughly a month before most administrators had any CVE to search for.

• On or around September 10, 2026: Administrators begin reporting unauthenticated attacks and unexpected PHP files in apps/richdocumentscode/ on the Nextcloud/Collabora GitHub issue tracker.
• September 11, 2026: richdocumentscode 26.4.303, which fixes the flaw, is released.
• October 3, 2026: A Nextcloud community member posts a public warning on the Nextcloud forum urging all "Built-in CODE Server" users to update immediately, well before an official CVE number was attached.
• October 14, 2026: CVE-2026-110447 and GitHub Security Advisory GHSA-f97p-r72q-64h2 are published.
• October 23, 2026: CISA adds CVE-2026-110447 to its Known Exploited Vulnerabilities catalog, with a remediation due date of October 26, 2026 for federal civilian agencies.

Note on dates: several secondary write-ups give slightly different "first observed" dates for exploitation (ranging from September 10 to mid-September); this article uses September 10, 2026, which is the date given directly in the original report on the richdocumentscode issue tracker and is consistent with the Nextcloud forum advisory's reference to reviewing logs "back to Sept 10."

How this differs from CVE-2025-66208

If you already patched Nextcloud against a different, earlier Collabora-related command-injection bug, CVE-2025-66208, you are still exposed to CVE-2026-110447. The GitHub Security Advisory for this new CVE explicitly states that it is a distinct issue from CVE-2025-66208, which was fixed separately in richdocumentscode 25.04.702. The two bugs live in related code paths around how the built-in CODE server is started and proxied, but closing one did not close the other. Admins who patched only for the 2025 issue, and assumed they were done, are among those most likely to still be running a vulnerable build.

How to check for compromise

Because exploitation predates public disclosure by roughly a month, updating today does not tell you whether you were already hit. Check for these indicators, drawn from the GitHub issue thread and corroborating reporting:

• Unexpected PHP files in apps/richdocumentscode/. Administrators repeatedly found web shells named with a shx prefix followed by random hexadecimal characters and a .php extension (for example, files matching the pattern shx*.php). These are typically tiny scripts that pass a request parameter straight into shell_exec().
• Suspicious requests to proxy.php?status in your web server access logs. Look for query strings or paths containing %2e%2e (encoded directory traversal), $( (command substitution), or ${IFS} (space obfuscation), especially clustered around September and October 2026.
• Failed sudo attempts by the web server account (e.g., www-data, apache, or whatever user your PHP process runs as), which several administrators flagged as a sign that an attacker-controlled shell was probing for privilege escalation after landing a web shell.
• Nextcloud's built-in integrity check. Multiple admins in the forum thread and issue tracker specifically credit Nextcloud's app integrity checker with flagging the extra, unauthorized PHP file that turned out to be a planted backdoor.
• Anomalous outbound requests from the web server account, including probes for password-manager databases, browser credential stores, and cryptocurrency wallet files.

If you find any of the above, treat the host as compromised: preserve the suspicious files and logs for investigation, assume anything readable by the web server account may have been accessed, and rotate any credentials or secrets that account could reach before you consider the server clean. This is the same "assume breach, then verify" posture worth applying any time a web-facing intrusion sits undetected for weeks before discovery — the dwell time here is exactly what made this one dangerous.

How to fix it

The remediation has two parts, and doing only the first one is not enough:

1. Update richdocumentscode to 26.4.303 or later (26.4.402 and 26.4.502 are newer releases that add additional hardening, including stopping the local Collabora process when the app itself is disabled). Update through the Nextcloud apps admin screen or your usual deployment pipeline.
2. Manually remove any leftover web shell files from apps/richdocumentscode/ and anywhere else on disk the web server account could write to. Updating the app does not delete files an attacker already planted.

Collabora's guidance, echoed across the advisory and the Nextcloud forum thread, is blunt: disabling the app in Nextcloud's admin UI is not sufficient to stop exploitation, because the vulnerable PHP script can still be reached directly by an unauthenticated web request even when the app shows as "disabled" inside Nextcloud. If you don't actually need the local, built-in CODE server — for instance, because you use a different document-editing backend, or don't need in-browser document editing at all — the safer option is to remove the app entirely rather than rely on disabling it.

One more wrinkle: the fixed richdocumentscode releases require Nextcloud Server 30 or newer. If you're still running Nextcloud 29 or earlier, which is end-of-life, there is no patched build available for your platform — your only options are to upgrade Nextcloud Server itself to a supported release, or remove the richdocumentscode app outright. This is the same kind of forced-upgrade bind seen with other end-of-life-adjacent KEV entries this year, including the Ivanti Connect Secure CVEs patched earlier in 2026, where delaying a platform upgrade left admins with no patch path at all.

Frequently asked questions

Do I need to do anything if I don't use the built-in CODE server?

If the "Collabora Online — Built-in CODE Server" app (richdocumentscode) was never installed, or if you only use richdocuments pointed at a separate, standalone Collabora Online instance, you are not affected by this specific CVE.

Will the update remove a web shell an attacker already planted?

No. Updating richdocumentscode closes the hole that let attackers in, but it will not retroactively delete files they already wrote to disk. You must check apps/richdocumentscode/ and run an integrity scan yourself.

Is this the same bug as CVE-2025-66208?

No. CVE-2025-66208 was an earlier, separate command-injection issue in the same general area, fixed in richdocumentscode 25.04.702. The GitHub advisory for CVE-2026-110447 is explicit that the two are distinct, and fixing the 2025 issue did not close this one.

What's next: what to do right now

If you run Nextcloud with the built-in CODE server app, treat this as a same-day task, not a "next maintenance window" task:

1. Check your installed richdocumentscode version today. If it's 26.4.302 or earlier, update to 26.4.303+ immediately, or remove the app if you don't need local document editing.
2. Search apps/richdocumentscode/ for unexpected PHP files, run Nextcloud's integrity check, and review web server access logs back through at least early September 2026 for hits on proxy.php?status.
3. If you find evidence of a web shell or suspicious requests, assume compromise: isolate the host, preserve logs and files for review, and rotate credentials reachable by the web server account before putting the server back into production.
4. If you're on Nextcloud 29 or earlier, plan an upgrade to a supported Nextcloud release — there is no fixed richdocumentscode build for end-of-life platforms.
5. Keep watching the official advisory and your Nextcloud app update feed; Collabora has already shipped additional hardening in 26.4.402 and 26.4.502 beyond the minimum fix.

Given that this flaw sat in active exploitation for roughly a month before a CVE number existed to search for, the practical lesson for any self-hosted groupware stack is the same one driving CISA's KEV program generally: don't wait for a CVE ID to act on a vendor's own "update now" warning.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage