Administrators running Nextcloud with the optional built-in Collabora Online Development Edition (CODE) server are being compromised through CVE-2026-110447, a critical unauthenticated OS command injection in the richdocumentscode app. Attackers have been dropping PHP webshells on affected hosts, with exploitation reportedly beginning around September 10, 2026. The fix shipped on September 11, but the advisory and CVE were not published until October 14, leaving a window of more than four weeks in which patched-silently instances were the only safe ones.

Technical details

The vulnerable component is the bundled CODE server that Nextcloud’s Collabora integration can run inside the Nextcloud app itself, fronted by the app’s proxy.php endpoint. A crafted request to that endpoint reaches a command-injection sink, and no authentication is required.

Reporting says the flaw is only reachable while the bundled server is not running, for example after a restart, an upgrade, or a crash of the helper process. That condition is common enough in practice, and it explains why some administrators saw compromises shortly after routine maintenance.

Severity scores differ between sources: one gives CVSS 4.0 9.2, another CVSS 3.1 9.8 alongside a CVSS 4.0 of 7.2. Treat it as critical either way, because the outcome is code execution as the web server user with no credentials.

This is a separate bug from CVE-2025-66208, an earlier proxy-related command injection in the same app that was fixed in release 25.04.702. According to one analysis, that earlier fix does not close the new flaw, so being current as of last year is not enough.

Who is affected

  • Nextcloud instances with the built-in CODE server app (richdocumentscode) at a version before 26.4.303.
  • Reportedly not affected, per Collabora: standalone Collabora Online servers, Docker and RPM/DEB installs, and Nextcloud All-in-One deployments.

Exploitation in the wild

Administrator reports describe attackers planting PHP webshells and then searching the host for password databases and cryptocurrency wallets. The Hacker News reports that three administrators confirmed compromises. Claims of ransomware involvement are unconfirmed, and no threat actor has been named publicly. Collabora attributed the late CVE publication to backlogs in GitHub’s CVE processing; Nextcloud said the delay gave users time to update.

Mitigation

  1. Update richdocumentscode to 26.4.303 or later, or remove the app entirely. Vendor guidance warns that merely disabling the app is not sufficient.
  2. If you run Collabora, prefer a separate, standalone Collabora Online server over the bundled CODE app, which keeps the document-rendering attack surface off the Nextcloud host.
  3. Hunt for compromise, especially on instances that were exposed since early September: look for unexpected .php files under the richdocumentscode and Nextcloud app directories, recent file modification times, and web server logs showing unauthenticated requests to proxy.php around restarts or upgrades.
  4. If a webshell is found, assume the web server user’s reach: rotate the Nextcloud config.php secrets and database credentials, revoke app passwords and sessions, and rotate any credentials or wallet files stored on the host. Rebuild from known-good media rather than cleaning in place.
  5. Restrict the Nextcloud instance’s exposure where possible (VPN, IP allow-listing) until patched.

Why it matters

Self-hosted collaboration stacks hold documents, credentials, and sync tokens, and are frequently exposed to the internet. This incident also repeats a pattern seen across recent edge and self-hosted software: exploitation began before public disclosure, and the CVE lagged the patch by weeks, so teams tracking only CVE feeds or KEV entries would have missed the signal. Watching vendor release notes for security-flavored fixes is part of the defense.

References