Nextcloud Built-in CODE RCE CVE-2026-110447 Exploited

What to do

1. Check whether the app is installed: sudo -u www-data php occ app:list | grep -A1 richdocumentscode.
2. Update it to 26.4.303 or later with occ app:update richdocumentscode, or remove it with occ app:remove richdocumentscode; disabling is not enough.
3. On Nextcloud 29 or older, remove the app now; the fixed version needs Nextcloud 30 or later.
4. Search apps/richdocumentscode and the rest of the Nextcloud tree for unexpected PHP files such as shx*.php, shrf*.php and Nx_*.php.
5. Grep web server logs back to September 10 for richdocumentscode/proxy.php requests containing %2e%2e, $(, ${IFS} or base64.
6. If you find a web shell, rotate the database password, app passwords and any secret the web server user could read, and review data in the Nextcloud data directory as exposed.

How to check if you are affected or compromised

• Run sudo -u www-data php occ integrity:check-core and look for EXTRA_FILE entries under apps/richdocumentscode.
• Search access logs for /apps/richdocumentscode/proxy.php?status requests with traversal, command substitution or base64 payloads, and for the IPs 139.28.18.122 and 89.38.98.50.
• Look for outbound requests to webhook.site from the web server and for coolwsd processes whose command line contains an injected URL.
• Compare one-line PHP shells against the SHA-256 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562 published by The Hacker News.

What happened#

On October 14, 2026, Collabora published GHSA-g3vx-3m76-fghh for CVE-2026-110447. The bug is an unauthenticated OS command injection (CWE-78) in proxy.php of richdocumentscode, the Nextcloud app "Collabora Online - Built-in CODE Server". A crafted request runs shell commands as the web server user. Collabora scores it CVSS 4.0 9.2.

The advisory came late. Attackers were using the bug before it existed. The first logged attack was on September 10. Administrators reported web shells in issue #354 on September 11, the day version 26.4.303 shipped the fix. That release's notes did not mention security. A Nextcloud forum post warned on October 3 that exploitation was under way. CISA added the CVE to the KEV catalog on October 23, with an October 26 due date for federal agencies.

According to The Hacker News, the script put request path text inside a double-quoted bash command, so $(...) in the URL was executed. The fix is four lines: the start command is now passed to bash as one escaped argument. Collabora says this is a different code path from CVE-2025-66208, and that fix does not cover it.

Who is affected#

• Affected: Nextcloud servers with richdocumentscode below 26.4.303 installed. This is the bundled AppImage CODE (Development Edition) that runs on the Nextcloud host itself.
• Disabled is not safe: Collabora says disabling the app does not prevent the issue. It must be upgraded or removed.
• End-of-life Nextcloud: 26.4.303 requires Nextcloud 30 or later. On Nextcloud 29 and older, the app store still serves a vulnerable version, so removing the app is the only fix.
• Not affected: standalone Collabora Online servers, CODE run from Docker or RPM/DEB packages, Nextcloud All-in-One, hosted Collabora services, and richdocuments (Nextcloud Office) used without the built-in server.

Do you really need to act?#

Yes, if the app is on your server. No login or user interaction is needed. The only precondition is that the local CODE server is not running when the request arrives, which happens after a restart, upgrade or crash. That is a weak barrier. Restarts are routine, and the CVE record's SSVC data marks the bug as automatable with total technical impact. The attacks were not theoretical. Attackers planted PHP web shells, sent uname -a output to webhook.site, and on one server searched for *.kdbx password databases and wallet.dat files. The logs reviewed showed no exfiltration and no root access. BleepingComputer could not confirm user reports of ransomware. Nextcloud said it had not seen widespread exploitation. How many servers were hit is not disclosed as of October 24, 2026.

The web server user can usually read config.php, which holds the database password, and the whole data directory. A web shell on a Nextcloud host therefore means every file stored there may be exposed. Patching does not remove a shell that is already in place.

What to do now#

1. Check for the app: sudo -u www-data php occ app:list | grep -A1 richdocumentscode. The app counts even if it appears under "Disabled".
2. Update it with sudo -u www-data php occ app:update richdocumentscode to 26.4.303 or later. Some users had startup problems with 26.4.402. A 26.4.502 build was published on October 23. If you do not need it, run occ app:remove richdocumentscode instead.
3. On Nextcloud 29 or older, remove the app and plan the Nextcloud upgrade.
4. For a durable setup, run CODE as a separate Docker or package install and point Nextcloud Office at it.
5. Hunt for shells (next section) before you consider the server clean.

How to tell if you were hit#

Search access logs back to September 10: zgrep 'richdocumentscode/proxy.php' /var/log/nginx/access.log* | grep -E '%2e%2e|\$\(|IFS|base64' (adjust the path for Apache). Reported payloads used %2e%2e traversal, $(...), ${IFS} and base64 piped to sh. The published source IPs are 139.28.18.122 and 89.38.98.50.

Look for files: find /var/www/nextcloud/apps -name 'shx*.php' -o -name 'shrf*.php' -o -name 'Nx_*.php'. Reported shell names include shrf4645.php, shxa35d0.php, shx5cf91.php, shx13a86.php and Nx_33143.php. Running occ integrity:check-core or upgrading Nextcloud flagged them as EXTRA_FILE for several administrators. If you find one, delete it, then rotate the database password, app passwords and anything else the web server user could read. Treat the stored data as exposed.

Timeline#

• Sep 9, 2026 — Fix committed to richdocumentscode.
• Sep 10, 2026 — First logged attack.
• Sep 11, 2026 — 26.4.303 released without a security note. Issue #354 reports web shells.
• Sep 24, 2026 — 26.4.402 released. Some users roll back to 26.4.303 after startup problems.
• Oct 3, 2026 — Nextcloud forum warns of active exploitation.
• Oct 14, 2026 — Collabora advisory and CVE-2026-110447 published.
• Oct 23, 2026 — CISA adds CVE-2026-110447 to KEV (due Oct 26). 26.4.502 released.

Vulnerability records

• CVE-2026-110447 · KEV 2026-10-23 · Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Collabora — GHSA-g3vx-3m76-fghh: Unauthenticated OS command injection in the richdocumentscode proxy github.com
2. CVE record — CVE-2026-110447 cve.org
3. CISA — Known Exploited Vulnerabilities catalog: CVE-2026-110447 cisa.gov
4. Nextcloud community forum — To Collabora Built-in user: update ASAP help.nextcloud.com
5. CollaboraOnline/richdocumentscode — Issue #354: Security issue - Hack github.com
6. CollaboraOnline/richdocumentscode — Releases github.com

Coverage and analysis

1. The Hacker News — Hackers backdoor Nextcloud servers through critical flaw in Collabora's Built-in CODE app thehackernews.com
2. BleepingComputer — Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers bleepingcomputer.com