Nextcloud's Built-in Collabora CODE Server Is Being Exploited - What to Do

Where things stand on 25 October 2026

The flaw is an operating system command injection in proxy.php, a file inside the Nextcloud app richdocumentscode. In the Nextcloud app list that app appears as Collabora Online - Built-in CODE Server, and it lets a Nextcloud server run its own copy of Collabora Online for document editing. A crafted web request can make the server run a command as the web server user, with no login needed. Collabora's advisory (GHSA-g3vx-3m76-fghh) rates CVE-2026-110447 as Critical, CVSS 4.0 score 9.2, and was published on 14 October 2026.

CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities (KEV) catalogue on 23 October 2026, with a due date of 26 October 2026 for US federal civilian agencies. That deadline does not bind UK businesses, but it is a useful marker of urgency. CISA's required action is to apply the vendor's mitigations, and its entry points to forensic triage requirements. Known ransomware use is listed as unknown.

The vendor's remedy is short: upgrade the app to 26.4.303 or later, or remove it. The advisory lists no other workaround. If you run Nextcloud 29 or older, which is end of life, the advisory says to upgrade Nextcloud or remove the app.

Check whether you are affected

You are in scope if the richdocumentscode app is present on your Nextcloud server at a version before 26.4.303 (26.4.302 and earlier). The advisory says disabling the app does not stop the attack, so a disabled copy still counts. If the app is not installed at all, this vulnerability does not apply to you, although the advice on checking for earlier compromise still makes sense if it was ever installed.

The maintainers have said this concerns only the Development Edition build that the built-in server mode downloads and runs locally. The advisory says standalone Collabora Online servers are not affected. That covers a Collabora server you run separately and connect to Nextcloud, rather than the built-in one.

• Affected: Nextcloud with the richdocumentscode app (Collabora Online - Built-in CODE Server) before version 26.4.303, enabled or disabled.
• Not affected, per the advisory: standalone Collabora Online servers.
• Not affected: Nextcloud servers that never had the richdocumentscode app installed.

1. Sign in to the Nextcloud server over SSH with an account that can run commands as the web server user. You will need shell access, so if Nextcloud is hosted for you, ask your provider to do this and confirm the result.
2. Go to the Nextcloud installation directory. If Nextcloud runs in a container, run the command inside that container. The web server user is often www-data, but yours may differ. The command only reads information.
   bashCopy

   sudo -u www-data php occ app:list

3. In the output, find richdocumentscode in the Enabled or Disabled list and note its version. Anything below 26.4.303 needs action. You can also see the version on the Apps page in the Nextcloud web interface.

Why the risk is real, and what is still unproven

Exploitation is more than theoretical. CISA's KEV listing is its evidence that this vulnerability is being used in attacks. The public first-hand reports come from Nextcloud administrators on the CollaboraOnline GitHub issue tracker and the Nextcloud community forum. They describe malicious requests to proxy.php in their logs from 10 and 11 September 2026, followed by small PHP web shells dropped inside the app folder. A web shell is a script that gives an attacker a remote command line through ordinary web requests. In one report the attacker searched for password-manager databases and cryptocurrency wallet files. The reporter saw no data being sent out, but anything the web server account could read should be treated as potentially exposed.

There is one condition on the attack. According to the advisory it works only while the built-in CODE server is not running, for example after a container restart, an upgrade or a crash. That narrows the window, but restarts are routine, so we would not treat it as protection.

The timing matters too. The fixed release 26.4.303 appeared on 11 September 2026, but the advisory and CVE record were not published until 14 October. Public reports say the release notes did not mention a security fix. A server that was updated as routine housekeeping is therefore safer from now on, but may have been attacked before it was updated. Treat the date of your update as part of the investigation, not as a clean bill of health.

The total number of affected servers is not known. We have not found any public statement naming an affected organisation, and none is named here.

Update the app to 26.4.303 or later

This needs Nextcloud administrator rights, or shell access as the web server user for the command route. Expect the built-in document editor to be briefly unavailable while the app updates. If you can snapshot the server first, do. A snapshot or a copy of the app folder also preserves evidence in case the checks in the next section find something, because cleaning up first destroys useful information.

1. Take a snapshot of the virtual machine or a copy of the apps/richdocumentscode folder if you can do so quickly. This is for evidence, so do not hold up the update if it is hard.
2. Update the app. You can do this from the Apps page in the Nextcloud web interface, or from the Nextcloud installation directory with the command shown. It changes the installed app, so run it as the web server user.
   bashCopy

   sudo -u www-data php occ app:update richdocumentscode

3. Run the app list command again. The richdocumentscode version should now read 26.4.303 or later. Newer releases such as 26.4.402 and 26.4.502 exist on the project's release page. The advisory names 26.4.303 as the fixed version, and says later versions are acceptable.
   bashCopy

   sudo -u www-data php occ app:list

If you cannot update: remove the app

Removal is the right route on Nextcloud 29 or older, where the advisory says to upgrade Nextcloud or remove the app, or if you do not actually use the built-in server. Removing richdocumentscode stops built-in document editing for your users until you connect a standalone Collabora server. It does not remove the richdocuments connector app. Do not simply disable the app and move on, because the advisory says that does not close the hole.

1. Remove the app from the Nextcloud installation directory as the web server user. This deletes the app and its built-in server files, so make sure nobody is relying on document editing at that moment.
   bashCopy

   sudo -u www-data php occ app:remove richdocumentscode

2. Confirm the folder is gone. Replace YOUR_NEXTCLOUD_PATH with the path of your Nextcloud installation. A message saying there is no such file or directory means removal worked.
   bashCopy

   ls YOUR_NEXTCLOUD_PATH/apps/richdocumentscode

Check whether the server was already attacked

Updating closes the door but does not tidy up behind an intruder. One administrator on the Nextcloud forum reported finding a leftover backdoor file after updating. Collabora's maintainers recommend deleting any lingering shx*.php files in the app folder even after updating.

These checks only read information. A clean result is encouraging, but not proof, especially if your logs have been rotated or deleted. Start from 10 September 2026, the earliest date in the public reports.

1. Run Nextcloud's integrity check for the app, from the Nextcloud installation directory. If the app is still installed, it lists files that should not be there. A removed app will simply report that it cannot be found, which is fine.
   bashCopy

   sudo -u www-data php occ integrity:check-app richdocumentscode

2. Search the app folder for web shell file names seen in public reports. Replace YOUR_NEXTCLOUD_PATH with your installation path. These names are not an exhaustive list, and one forum user found a differently named file, so the integrity check in the previous step matters more.
   bashCopy

   find YOUR_NEXTCLOUD_PATH/apps/richdocumentscode \( -name 'shx*.php' -o -name 'shrf*.php' \) -print

3. Search your web server access logs for proxy.php requests containing the traversal and command-substitution patterns seen in the attacks. Replace YOUR_ACCESS_LOG with the path of your log, and repeat for older or compressed rotated logs, and for any reverse proxy or firewall logs in front of the server. Any hit means you should treat the server as attacked and go to the next section.
   bashCopy

   grep -i 'proxy.php' YOUR_ACCESS_LOG | grep -i -E '%2e%2e|%24%28|[$][(]|[$][{]IFS[}]'

4. Check for alerts on the server such as failed sudo attempts by the web server user. One administrator discovered their compromise through failed-sudo email alerts.

If you find a web shell or suspicious requests

This is now a security incident, and the sensible tone is calm and methodical. Deleting the file is not enough, because the attacker could already run commands as the web server user and may have left other access. The UK NCSC's guidance on actively exploited vulnerabilities says to investigate for compromise in parallel with patching, and that if you cannot verify a system is clean you should erase and rebuild it. It also suggests engaging an assured incident response provider where possible.

Where the checks are not clean, this is our suggested order of work, based on that guidance and the public reports.

• Keep a copy of the web shell, the relevant logs and a snapshot before cleaning anything up, then isolate the server from the internet if the business can tolerate the outage.
• Assume anything the web server account could read is exposed. In our judgement that includes the database password in the Nextcloud configuration, app passwords, and credentials for connected storage, mail or other services. Change them from a trusted machine once the server is isolated or rebuilt.
• Look beyond the app folder for new user accounts, unexpected files, scheduled jobs and unusual outbound connections. If you cannot show the server is clean, restore or rebuild from a state before 10 September 2026 rather than trusting a patched copy.
• If personal data may have been exposed, UK GDPR requires you to tell the ICO about a breach that is likely to pose a risk to individuals without undue delay and within 72 hours of becoming aware of it. Record your reasoning either way.
• Report a confirmed or suspected compromise through the NCSC reporting route at gov.uk/report-cyber.