Nextcloud: attackers plant web shells through Collabora’s Built-in CODE Server app, update or remove it now
Critical CVE-2026-110447 Nextcloud Linux PHP

A critical flaw in the optional Nextcloud app Collabora Online - Built-in CODE Server lets anyone run system commands on the server without logging in. It has been exploited since at least 10 September; Collabora published the advisory, CVE-2026-110447, on 14 October.

What happened

On 14 October 2026, Collabora published advisory CVE-2026-110447 (CVSS 4.0: 9.2), an unauthenticated command injection in proxy.php of the Nextcloud app Collabora Online - Built-in CODE Server (richdocumentscode). This app lets Nextcloud run an office suite on the same server without a separate Collabora installation. A crafted request makes the server run an operating system command with the rights of the web server user.

The advisory was late, but the attacks were not. On 11 September, an administrator hosting several Nextcloud servers opened an issue on the app’s GitHub page to report successful intrusions since the previous day, with logs dated 10 September. Other administrators then described PHP files named shx…php appearing in their installation, and failed sudo attempts on the server. The fixed version, 26.4.303, was released on 11 September.

Who is affected

Every Nextcloud with the Built-in CODE Server app in a version older than 26.4.303. The flaw can only be triggered while the built-in office server is not running: after a container restart, an upgrade or a crash. Disabling the app is not enough, according to Collabora: it must be updated or removed. Standalone Collabora Online servers are not affected.

What to do now

  1. Check whether the app is present: sudo -u www-data php occ app:list | grep richdocumentscode.
  2. Update it to 26.4.303 or later (occ app:update richdocumentscode), or remove it (occ app:remove richdocumentscode). On Nextcloud 29 or older, which no longer receives updates, upgrade Nextcloud or remove the app.
  3. Look for web shells: find /var/www/nextcloud -name 'shx*.php', then occ integrity:check-core. Delete any file found.
  4. Read the web server logs since 10 September for requests to the app’s proxy.php from unknown addresses, and look for odd processes running as www-data.
  5. If a web shell was there, consider the server compromised: the web server account can read config.php. Change the database password, the secrets and the administrator passwords, and preferably rebuild the server.

Our take

An optional add-on installed in one click becomes part of the attack surface of the whole Nextcloud. Keep an inventory of the apps actually in use, remove the others, and do not wait for a CVE number before applying an update that the community already describes as a security fix.

Sources

How we choose, verify and write our analyses →

Is your own server exposed? Run a free check — public information only, no intrusion:

Check a server Check a website

Worried your servers are exposed? Our team audits, patches and monitors Linux and cloud infrastructure 24/7.

Talk to an expert Our managed server services →
Back to all news