On this page (8 sections)
A critical OS command injection in the Nextcloud app "Collabora Online - Built-in CODE Server" (richdocumentscode) is being exploited in the wild. The flaw is tracked as CVE-2026-110447, and CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-23, according to the CISA KEV entry.
If you run Nextcloud with this built-in app, update it and check the server for unexpected PHP files. Patching closes the hole but does not remove a web shell that was planted earlier. Standalone Collabora servers are not affected.
At a glance
What happened
A Nextcloud community member posted on October 3, 2026 that the built-in Collabora app fixed a shell command injection that was already being exploited, and that some users had found web shells on their servers (Nextcloud forum). At that point no CVE had been published. The CVE was published on October 14, and the description says exploitation occurred in September and October 2026.
On October 23 CISA added the flaw to KEV. CISA's entry says forensic triage is required under its BOD 26-04 directive, which tells you how it views the risk: assume possible compromise, not just a missing patch. The forum thread also notes that, as of October 26, some people were still running vulnerable versions.
Technical details
The weakness is an OS command injection (CWE-78) in proxy.php. Per the GitHub advisory, it is reachable when the CODE server is not running, for example right after the product was restarted. In plain terms, the app builds a shell command from input it does not properly sanitize, so an attacker can make the server run commands of their choosing.
The CVSS v4 metrics in the advisory describe network attack vector, low attack complexity, no privileges required and no user interaction, with high impact on confidentiality, integrity and availability. The forum post says the problem is in the way the built-in app starts Collabora using a PHP exec, not in Collabora itself. This is a different vulnerability from CVE-2025-66208, according to the CVE description.
Who is affected
Only the combination of Nextcloud plus the richdocumentscode app is affected. According to the forum post, you are not affected if you use the richdocuments app without richdocumentscode, run Collabora in Docker or from a Linux distribution package, or use a hosted Collabora service.
Exposure is highest on instances reachable from the internet where the built-in CODE server was ever restarted, upgraded or crashed, since that is the state the flaw depends on. One forum reply also suggests a disabled app may not be a safe state, so removing or updating the app is the safer assumption. That is a community comment rather than a vendor statement.
How to check your exposure
First, find out whether the app is installed and which version it is. This read-only Nextcloud occ command lists installed apps and versions; look for richdocumentscode and compare against 26.4.303. Run it as the web server user from your Nextcloud directory (adjust the user for your setup).
sudo -u www-data php occ app:list | grep -i richdocumentsNext, look for files that should not be there. A forum user reported that Nextcloud's integrity check flagged an extra PHP file inside the richdocumentscode app directory after updating, and the file contained a one-line backdoor. This read-only command lists PHP files in that directory so you can review anything unfamiliar against a clean copy of the app.
find apps/richdocumentscode -maxdepth 1 -name '*.php' -type fThen review web server access logs. A community reply suggests searching back to around September 10 for requests to proxy.php with a status parameter. This grep searches for that pattern; adjust the log path to your server. Hits are not proof of compromise, but they tell you where to look.
grep -i 'proxy.php' /var/log/nginx/access.log* /var/log/apache2/access.log* 2>/dev/nullWhat to do now
0 of 8 done
CISA's required action is to apply mitigations per vendor instructions and follow its triage guidance, or discontinue use of the product if mitigations are unavailable. Its listed due date was 2026-10-26, which has already passed, so this is overdue for anyone it applies to.
Detection and monitoring afterwards
After patching, keep watching for changes you did not make. File integrity checks on application directories, alerts on new PHP files in app folders, and regular log review catch the kind of leftovers described above. Our guide on how to check if a website is hacked and what to do if your website is hacked cover cleanup in more depth.
From the outside, you can use Webforta's free malware scanner for a quick look at a public site, but outside-in scanning cannot see files hidden on the server, so it does not replace the local checks above. For unexpected certificate, DNS or header changes on your Nextcloud host, monitoring can add an extra signal.
Be careful with third-party self-test pages and checklists linked in forum threads. Nextcloud's own forum moderators flagged one poster for possible spam. Stick to the vendor, CISA and GitHub advisory sources for guidance.
Timeline
| Date | Event |
|---|---|
| September and October 2026 | Exploitation in the wild, per the CVE description |
| 2026-10-03 | Nextcloud forum warning to update; web shells reported |
| 2026-10-14 | CVE-2026-110447 published |
| 2026-10-23 | Added to CISA KEV; due date 2026-10-26 |
| 2026-10-26 | GitHub advisory last updated; forum notes some users still affected |
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.