Nextcloud Servers Hacked Through Collabora Built-in CODE: CVE-2026-110447 and How to Check Yours

On 23 October 2026 the US Cybersecurity and Infrastructure Security Agency added CVE-2026-110447 to its catalogue of actively exploited vulnerabilities. The flaw sits in Collabora Online Built-in CODE Server, a Nextcloud app that lets users edit Word, Excel, and PowerPoint files in the browser without setting up a separate office server. It allows anyone on the internet to run commands on the server without logging in. Attacks started in early September, more than a month before the advisory was published, so patching now has to go together with checking whether someone got in first.

Who Is Affected

The vulnerability affects only one specific setup: Nextcloud with the Collabora Online - Built-in CODE Server app installed, package name richdocumentscode, at a version below 26.4.303. This app bundles a small document server inside Nextcloud itself. It is popular with small offices, schools, and teams running their own Nextcloud, because it makes online editing work in a few clicks without a second server.

To check, run sudo -u www-data php occ app:list | grep -i richdocumentscode from the Nextcloud directory, or open Apps in the admin panel and look for Collabora Online - Built-in CODE Server. Adjust www-data to the user your web server runs as.

How the Attack Works

Collabora describes the issue as an operating system command injection through the app's proxy.php script. A crafted request makes the server run a command as the web server user, with no login required. Collabora has not published a technical write-up, but researchers who compared the vulnerable and fixed code point to the function that starts the bundled document server. It assembled a shell command from parts of the incoming request, and the way those values were quoted still let command substitution through.

There is one condition: the attack works only while the bundled document server is not running. That happens after a container restart, an upgrade, or a crash, which on a typical server occurs often enough for an automated scanner to find the window.

The web server user can usually read the whole Nextcloud installation, including config.php with the database password and application secrets, and every file in the data directory. In practice, that means the documents of every user on the server.

Disabling the App Is Not Enough

This is the point most likely to catch administrators out. Disabling an app in Nextcloud stops it from loading inside Nextcloud, but proxy.php is still a file in the apps directory and the web server still serves it directly. Collabora states plainly that the app must be upgraded to 26.4.303 or later, or removed. Turning it off is not a fix.

Timeline

The gap between the fix and the advisory matters. For more than a month, the only public signal was a routine-looking update, so administrators who did not apply app updates promptly had no reason to treat it as urgent. Meanwhile, the change was visible in a public repository, and the first recorded attack came less than a day after it was committed.

What Attackers Did

Reports from administrators on GitHub and from national CSIRTs describe a consistent pattern. The attacker writes a small PHP web shell into the richdocumentscode app folder, usually with a name starting with shx or shrf, then uses it to explore the server. On one server, the attacker searched for password manager databases such as KeePass files and for cryptocurrency wallets. Italy's national cybersecurity agency described a compromised server where three web shells were installed and a configuration file containing credentials and application secrets was taken. It described the campaign as automated, involving several actors, and still active. CERT Polska warned that the flaw is also being used for ransomware attacks.

Updating the app replaces its files but does not remove what an attacker added to the server. A web shell left behind keeps working after the patch.

Upgrade or Remove the App

1. 1Check the Nextcloud version. Fixed releases of richdocumentscode require Nextcloud 30 or later. Nextcloud 29 and older are end of life, and the newest app version offered to them, 26.4.104, is still vulnerable. On those servers, either upgrade Nextcloud or remove the app.
2. 2On Nextcloud 30 or later, update the app with sudo -u www-data php occ app:update richdocumentscode, or through the Apps page in the admin panel.
3. 3Confirm the installed version is 26.4.303 or later with occ app:list.
4. 4If you do not need online editing, remove the app entirely with sudo -u www-data php occ app:remove richdocumentscode.

Some administrators reported that 26.4.402 failed to start the document server or open files on their setup, and that returning to 26.4.303 solved it. If that happens to you, go back to 26.4.303, not to anything older.

Checking Whether the Server Was Compromised

Do this even if you have already updated, and look back to at least 10 September 2026. Before cleaning anything, copy the logs and a listing of the app directory somewhere safe, so the evidence survives if you need it later.

• Run sudo -u www-data php occ integrity:check-app richdocumentscode and investigate any file the integrity check does not recognise.
• Look for PHP files that should not be there: find /var/www/nextcloud/apps/richdocumentscode -name "*.php" and pay attention to names such as shx*.php, shrf*.php, or Nx_*.php. Adjust the path to your installation.
• Search the web server access logs for requests to richdocumentscode/proxy.php that contain encoded shell syntax such as %24%28, $(, ${IFS}, or %2e%2e.
• Check outgoing connections from the server to webhook.site, a legitimate service that attackers used to receive callbacks.
• Watch for unusual activity by the web server user, such as failed sudo attempts or searches for .kdbx, wallet.dat, or keystore.json files.

A clean result does not prove the server is clean. File names vary between attacks and logs may have been rotated. If you find anything suspicious, treat the server as compromised: isolate it, preserve the evidence, and from a trusted machine change the database password, mail account passwords, app passwords, and API keys for any integration whose secrets were readable by the web server. Check whether any of those credentials are reused on other systems. In most cases, rebuilding the server and restoring data from a clean backup is safer than trying to remove every trace by hand.

A Better Setup for Production

Collabora itself describes the Built-in CODE Server as suitable for testing and small, non-production use. For a company that stores contracts, invoices, and HR files in Nextcloud, a separate Collabora Online server, typically run from the official Docker image behind a reverse proxy, is easier to update, can be restricted on the network, and keeps the document engine away from the Nextcloud web root. It was also unaffected by this vulnerability.

The broader lesson is about app updates. Nextcloud apps update separately from Nextcloud itself, and in this case the security fix arrived as a quiet patch release a month before anyone called it a security fix. Applying app updates on a schedule, rather than waiting for an advisory, would have closed the hole in September. If you would like help reviewing or hardening a self-hosted Nextcloud, our managed service team can take it on.