Nextcloud Vulnerability Lets Hackers Backdoor Servers: Patch Now

Attackers have been quietly backdooring self-hosted Nextcloud servers since September 2026 by abusing a critical flaw in Collabora's built-in CODE server, the optional document-editing component many Nextcloud admins bundle with their install. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the bug, tracked as CVE-2026-110447, to its Known Exploited Vulnerabilities (KEV) catalog on October 23, 2026, with a patch-or-mitigate deadline of October 26 for federal civilian agencies. If you run Nextcloud with the built-in CODE server app enabled, the short answer is: update to Collabora Online 26.4.303 or later now, or remove the app — disabling it is not enough.

Why this matters: Nextcloud's reach

Nextcloud is one of the most widely deployed self-hosted alternatives to Google Drive and Microsoft 365 — the open-source platform that governments, universities, hospitals and privacy-conscious businesses run on their own servers specifically so their files, calendars and documents don't live on a third-party cloud. Part of the appeal is that Nextcloud bundles in-browser document editing out of the box, powered by a built-in version of Collabora's CODE (Collabora Online Development Edition) server, so admins don't have to stand up and maintain a separate office suite. That convenience is exactly what's exposed here: the built-in CODE app is the thing with the flaw, not Nextcloud's core file-sync code.

Because Nextcloud is popular precisely with organizations that care about controlling their own data, a bug that lets an outsider silently plant a web shell and walk off with the server's own credentials is a particularly bad fit for its typical audience.

What is CVE-2026-110447?

CVE-2026-110447 is an OS command injection vulnerability in the built-in CODE server that ships as an optional app, richdocumentscode, inside Nextcloud. According to the GitHub Security Advisory GHSA-f97p-r72q-64h2, the flaw lives in the app's proxy.php script, which passed request data into a system command without properly sanitizing it. That let an unauthenticated attacker run arbitrary operating-system commands as the web server's user account — full remote code execution, no login required.

The advisory rates the bug Critical with a CVSS v4.0 score of 9.2 and lists the weakness as CWE-78 (improper neutralization of special elements used in an OS command). It was published on GitHub on October 14, 2026, and most recently updated October 26, 2026, the same week CISA finalized its KEV listing.

In plain terms, an OS command injection bug happens when a program builds a command for the underlying operating system — in this case, something the CODE server's proxy script runs to manage its own process — and splices in data from an incoming request without stripping out characters that have special meaning to the shell. An attacker who understands the format can smuggle in their own command alongside the legitimate one, and the server will run both. Because no login is required and the resulting command executes with the web server's own permissions, this class of bug routinely converts a single network request into full control of a machine, which is exactly the pattern CISA, Collabora and independent researchers are describing here.

Why this only hits Nextcloud, not Collabora Online generally

This point trips a lot of admins up: the bug is not in Collabora Online itself. It's specific to the convenience "built-in CODE server" that Nextcloud offers so admins don't have to stand up a separate Collabora Online or Collabora Online Development Edition (CODE) instance. Collabora's advisory and CISA's KEV entry both note that standalone Collabora Online servers — including Docker, RPM, and DEB packaged installs, and Nextcloud All-in-One's own hardened deployment path — are not affected. If your office-document editing in Nextcloud runs through an external, separately managed Collabora Online or OnlyOffice server rather than the bundled app, this particular CVE doesn't apply to you.

How attackers are exploiting it

The command injection only fires under a specific condition: the local CODE server process has to be stopped — for example, during a restart, an in-place upgrade, or after a crash. Because the built-in CODE server is designed to restart automatically, that's a narrow but recurring window, and attackers scanning for exposed Nextcloud instances have been catching it. Reporting referenced in the GitHub advisory places active, in-the-wild exploitation starting around September 10, 2026, roughly a month before the public advisory and CISA's KEV addition.

Once attackers get code execution, the pattern has been consistent: drop a PHP web shell into a writable path for persistent access, then go after the Nextcloud instance's own configuration files — which routinely contain database credentials, mail credentials, and app secrets — for follow-on access to the rest of the environment.

That second step is what makes this bug more dangerous than a typical single-server compromise. Nextcloud's config.php file is a hub, not a dead end: it holds the database password, often SMTP/mail credentials, and secrets for any connected apps or external storage. An attacker who reaches it doesn't just own the one Nextcloud box — they potentially own a path into the database server, the mail system, and anything else the instance was configured to talk to. That's a meaningfully larger blast radius than, say, a defaced web page, and it's why CISA treats "forensic triage required" as part of this KEV entry rather than a routine patch-and-move-on.

Am I affected?

You're in the exposed group if all of the following are true:

• You self-host Nextcloud (server or Nextcloud All-in-One) and enabled the built-in office-editing app, which uses the richdocumentscode package to run a local Collabora CODE server.
• Your installed Collabora Online CODE server build predates version 26.4.303.
• The instance is reachable from the internet, or from any network an attacker could reach, rather than kept strictly internal.

You're not in the exposed group — for this specific CVE — if you connect Nextcloud to an external, separately managed Collabora Online or Collabora Online Development Edition server, or if you never enabled in-app document editing at all.

If you're not sure which setup you're running, check the version listed for the "Collabora Online – Built-in CODE Server" app under Nextcloud's admin apps page before assuming you're in the clear.

How to patch and mitigate

Collabora's fix landed in Collabora Online 26.4.303. CISA's guidance, and Collabora's own advisory, are explicit that simply disabling the built-in CODE app in Nextcloud's app settings does not close the hole — the vulnerable code can still be reached on disk even when the app shows as off in the admin UI. Admins need to either:

1. Update the built-in CODE server package to 26.4.303 or later through the Nextcloud apps admin panel, or
2. Remove the richdocumentscode app entirely if an update isn't immediately possible, then reassess whether to move to an externally managed Collabora or OnlyOffice server instead of the bundled option.

Because the bug is only reachable while the CODE server is stopped, anyone who has recently restarted, upgraded, or had the service crash on an un-patched instance should treat that window as a potential exposure and check for unfamiliar PHP files or outbound connections, not just patch and move on. Nextcloud's own server hardening guide is a good baseline for reducing exposure on any self-hosted instance generally, beyond this one CVE, and covers firewalling internal services, running behind a reverse proxy, and keeping the underlying OS patched.

For anyone running Nextcloud behind a managed service or hosting provider, it's worth confirming directly with that provider whether they've already pushed the update — many managed Nextcloud offerings patch the bundled CODE server on the customer's behalf, but not all of them do it automatically or immediately.

CISA's deadline and what BOD 26-04 means here

CISA's KEV catalog entry for CVE-2026-110447 lists an October 26, 2026 due date and flags it as requiring forensic triage under Binding Operational Directive 26-04. BOD 26-04 is the directive, issued in mid-2026, that sets vulnerability-management requirements for U.S. federal civilian executive branch (FCEB) agencies, replacing older directives from 2019 and 2021. It ranks vulnerabilities by risk factors like public exposure and whether exploitation can be automated, and assigns remediation windows that range from a few days up to 60, depending on severity — the three-day-and-under tier is reserved for flaws that are already being mass-exploited and give an attacker full control, which is squarely where this one lands.

BOD 26-04 doesn't legally bind private companies or individual self-hosters, but CISA's standing guidance is that every organization treat KEV catalog entries as a prioritized remediation list regardless of sector. For a bug that's already being used to plant web shells and steal credential-bearing config files, that guidance is worth following even outside government networks — the federal deadline is really just a signal of how seriously CISA is treating the risk, not a cutoff that applies only to agencies.

What next

If you administer a Nextcloud instance, check your CODE server version today. Confirm the update landed, then audit for signs of prior compromise — unexpected PHP files outside your normal app directories, modified configuration files, or outbound connections from the server you can't account for — since the exploitation window traces back over a month before the public disclosure. If you find anything suspicious, rotate every credential stored in config.php as a precaution, since that file is exactly what this attack chain targets. Nextcloud maintains a running security advisories page worth bookmarking if you administer an instance long-term.

Pandromeda has also covered other recent entries on CISA's KEV catalog, including the Arista VeloCloud Orchestrator zero-day added the same week, and explained how the broader category of attack behind incidents like this one works in what a supply chain attack is and how to stay safe. Note that this Nextcloud/Collabora flaw is unrelated to the separate PHP2Shell vulnerabilities in PHP itself that Pandromeda covered earlier this week — different code, different vendor, different fix.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage