---
title: "Nextcloud Built-in CODE RCE CVE-2026-110447 Exploited"
url: https://erroneo.us/security/briefs/nextcloud-collabora-built-in-code-cve-2026-110447-rce/
description: "Unauthenticated command injection in Collabora's Built-in CODE Server app for Nextcloud, exploited since September and now in KEV. Fixed in 26.4.303."
type: security-brief
section: "Security Digest"
date_published: 2026-10-14
date_modified: 2026-10-24
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-110447"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Nextcloud Built-in CODE RCE CVE-2026-110447 Exploited

**Verdict: Act now.** If your Nextcloud has the Built-in CODE Server app installed, enabled or not, update or remove it today and then hunt for web shells: attackers have used this since September 10.

- **Who must act:** Nextcloud administrators who have the richdocumentscode app (Collabora Online - Built-in CODE Server) below 26.4.303 installed, including servers where the app is disabled or the Nextcloud release is end-of-life.
- **Who can relax:** Nextcloud Office users who point richdocuments at a standalone Collabora Online server, Docker or distribution-package CODE, Nextcloud All-in-One, or a hosted Collabora service.
- **Affected:** richdocumentscode (Collabora Online - Built-in CODE Server) before 26.4.303; Nextcloud 29 and older with the app installed (cannot install the fixed version)
- **Fixed:** richdocumentscode 26.4.303 and later (requires Nextcloud 30 or later); Removing the richdocumentscode app
- **CVEs:** CVE-2026-110447
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check whether the app is installed: sudo -u www-data php occ app:list | grep -A1 richdocumentscode.
2. Update it to 26.4.303 or later with occ app:update richdocumentscode, or remove it with occ app:remove richdocumentscode; disabling is not enough.
3. On Nextcloud 29 or older, remove the app now; the fixed version needs Nextcloud 30 or later.
4. Search apps/richdocumentscode and the rest of the Nextcloud tree for unexpected PHP files such as shx*.php, shrf*.php and Nx_*.php.
5. Grep web server logs back to September 10 for richdocumentscode/proxy.php requests containing %2e%2e, $(, ${IFS} or base64.
6. If you find a web shell, rotate the database password, app passwords and any secret the web server user could read, and review data in the Nextcloud data directory as exposed.

### How to check if you are affected

- Run sudo -u www-data php occ integrity:check-core and look for EXTRA_FILE entries under apps/richdocumentscode.
- Search access logs for /apps/richdocumentscode/proxy.php?status requests with traversal, command substitution or base64 payloads, and for the IPs 139.28.18.122 and 89.38.98.50.
- Look for outbound requests to webhook.site from the web server and for coolwsd processes whose command line contains an injected URL.
- Compare one-line PHP shells against the SHA-256 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562 published by The Hacker News.

## What happened

On October 14, 2026, Collabora published [GHSA-g3vx-3m76-fghh](https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh) for [CVE-2026-110447](https://www.cve.org/CVERecord?id=CVE-2026-110447). The bug is an unauthenticated OS command injection (CWE-78) in `proxy.php` of `richdocumentscode`, the Nextcloud app "Collabora Online - Built-in CODE Server". A crafted request runs shell commands as the web server user. Collabora scores it CVSS 4.0 9.2.

The advisory came late. Attackers were using the bug before it existed. The first logged attack was on September 10. Administrators reported web shells in [issue #354](https://github.com/CollaboraOnline/richdocumentscode/issues/354) on September 11, the day version 26.4.303 shipped the fix. That release's notes did not mention security. A [Nextcloud forum post](https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516) warned on October 3 that exploitation was under way. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110447) on October 23, with an October 26 due date for federal agencies.

According to [The Hacker News](https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html), the script put request path text inside a double-quoted bash command, so `$(...)` in the URL was executed. The fix is four lines: the start command is now passed to bash as one escaped argument. Collabora says this is a different code path from CVE-2025-66208, and that fix does not cover it.

## Who is affected

- **Affected:** Nextcloud servers with `richdocumentscode` below 26.4.303 installed. This is the bundled AppImage CODE (Development Edition) that runs on the Nextcloud host itself.
- **Disabled is not safe:** Collabora says disabling the app does not prevent the issue. It must be upgraded or removed.
- **End-of-life Nextcloud:** 26.4.303 requires Nextcloud 30 or later. On Nextcloud 29 and older, the app store still serves a vulnerable version, so removing the app is the only fix.
- **Not affected:** standalone Collabora Online servers, CODE run from Docker or RPM/DEB packages, Nextcloud All-in-One, hosted Collabora services, and `richdocuments` (Nextcloud Office) used without the built-in server.

## Do you really need to act?

**Yes, if the app is on your server.** No login or user interaction is needed. The only precondition is that the local CODE server is not running when the request arrives, which happens after a restart, upgrade or crash. That is a weak barrier. Restarts are routine, and the CVE record's SSVC data marks the bug as automatable with total technical impact. The attacks were not theoretical. Attackers planted PHP web shells, sent `uname -a` output to webhook.site, and on one server searched for `*.kdbx` password databases and `wallet.dat` files. The logs reviewed showed no exfiltration and no root access. [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/) could not confirm user reports of ransomware. Nextcloud said it had not seen widespread exploitation. How many servers were hit is not disclosed as of October 24, 2026.

The web server user can usually read `config.php`, which holds the database password, and the whole data directory. A web shell on a Nextcloud host therefore means every file stored there may be exposed. Patching does not remove a shell that is already in place.

## What to do now

1. Check for the app: `sudo -u www-data php occ app:list | grep -A1 richdocumentscode`. The app counts even if it appears under "Disabled".
2. Update it with `sudo -u www-data php occ app:update richdocumentscode` to 26.4.303 or later. Some users had startup problems with 26.4.402. A 26.4.502 build was published on October 23. If you do not need it, run `occ app:remove richdocumentscode` instead.
3. On Nextcloud 29 or older, remove the app and plan the Nextcloud upgrade.
4. For a durable setup, run CODE as a separate Docker or package install and point Nextcloud Office at it.
5. Hunt for shells (next section) before you consider the server clean.

## How to tell if you were hit

Search access logs back to September 10: `zgrep 'richdocumentscode/proxy.php' /var/log/nginx/access.log* | grep -E '%2e%2e|\$\(|IFS|base64'` (adjust the path for Apache). Reported payloads used `%2e%2e` traversal, `$(...)`, `${IFS}` and base64 piped to `sh`. The published source IPs are 139.28.18.122 and 89.38.98.50.

Look for files: `find /var/www/nextcloud/apps -name 'shx*.php' -o -name 'shrf*.php' -o -name 'Nx_*.php'`. Reported shell names include `shrf4645.php`, `shxa35d0.php`, `shx5cf91.php`, `shx13a86.php` and `Nx_33143.php`. Running `occ integrity:check-core` or upgrading Nextcloud flagged them as `EXTRA_FILE` for several administrators. If you find one, delete it, then rotate the database password, app passwords and anything else the web server user could read. Treat the stored data as exposed.

## Timeline

- Sep 9, 2026 — Fix committed to richdocumentscode.
- Sep 10, 2026 — First logged attack.
- Sep 11, 2026 — 26.4.303 released without a security note. Issue #354 reports web shells.
- Sep 24, 2026 — 26.4.402 released. Some users roll back to 26.4.303 after startup problems.
- Oct 3, 2026 — Nextcloud forum warns of active exploitation.
- Oct 14, 2026 — Collabora advisory and CVE-2026-110447 published.
- Oct 23, 2026 — CISA adds CVE-2026-110447 to KEV (due Oct 26). 26.4.502 released.

## Sources

1. [Collabora — GHSA-g3vx-3m76-fghh: Unauthenticated OS command injection in the richdocumentscode proxy](https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh)
2. [CVE record — CVE-2026-110447](https://www.cve.org/CVERecord?id=CVE-2026-110447)
3. [CISA — Known Exploited Vulnerabilities catalog: CVE-2026-110447](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110447)
4. [Nextcloud community forum — To Collabora Built-in user: update ASAP](https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516)
5. [CollaboraOnline/richdocumentscode — Issue #354: Security issue - Hack](https://github.com/CollaboraOnline/richdocumentscode/issues/354)
6. [CollaboraOnline/richdocumentscode — Releases](https://github.com/CollaboraOnline/richdocumentscode/releases)
7. [The Hacker News — Hackers backdoor Nextcloud servers through critical flaw in Collabora's Built-in CODE app](https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html)
8. [BleepingComputer — Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers](https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/)

---
Source page: https://erroneo.us/security/briefs/nextcloud-collabora-built-in-code-cve-2026-110447-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt