Nextcloud: web shells via critical flaw in Collabora CODE

A critical vulnerability in the Collabora Online – Built-in CODE Server app (richdocumentscode) for Nextcloud is being exploited to plant web shells on servers. The flaw is tracked as CVE-2026-110447: according to CERT.LV it has a CVSS score of 9.2, allows operating system commands to be executed without authentication and is already used in real-world attacks. The Hacker News and BleepingComputer report that compromised servers have been backdoored.

What matters most for Nextcloud administrators is the timing: the fixed version has been available since 11 September, but the advisory and the CVE only came out on 14 October. According to BleepingComputer, attacks had already begun in mid-September.

Technical details

• Component: the optional Built-in CODE Server app, which starts a Collabora server bundled inside Nextcloud. The flaw is in the mechanism the app uses to start this server, in the proxy.php file.
• Type: OS command injection. A crafted request to proxy.php runs arbitrary commands on the server, with the privileges of the process serving Nextcloud.
• Requirements: no authentication and no user interaction. The necessary condition is that the built-in CODE server is not running, as happens after a restart, an upgrade or a crash.
• Affected versions: richdocumentscode 26.4.302 and earlier. Fixed: 26.4.303 and later.
• Not affected, according to Collabora (quoted by BleepingComputer): standalone Collabora Online servers, Docker and RPM/DEB package installations, and Nextcloud All-in-One.

The stopped-server condition should not be underestimated: restarts and upgrades are routine operations, so every instance running the vulnerable app is exposed at every maintenance window.

What the attackers did

Information about the attacks comes from reports by several administrators, collected by BleepingComputer:

• the first attacks against multiple servers date back to 10 September;
• after gaining access, the attackers uploaded PHP web shells;
• the web shells were used to search for password databases, password manager files and cryptocurrency wallets.

Some users also mention ransomware groups exploiting the flaw, but BleepingComputer states it could not confirm this. The sources do not report any public indicators of compromise, such as IP addresses or web shell file names.

The MITRE ATT&CK techniques matching the described chain are T1190 (Exploit Public-Facing Application), T1059.004 (Unix Shell), T1505.003 (Web Shell) and T1552.001 (Credentials In Files).

A fix without a CVE for a month

The timeline reconstructed by BleepingComputer:

• 9 September: the fix is committed to the code;
• 11 September: version 26.4.303 is released;
• mid-September: the maintainers issue warnings and the attacks begin;
• 3 October: a community warning urges administrators to update immediately, since attacks are ongoing;
• 14 October: the security bulletin, the GitHub advisory and the CVE are published.

Nextcloud told BleepingComputer that Collabora reported the vulnerability in mid-September and that the update was distributed through the app store. It justified the wait as giving users time to update, adding that it had not observed widespread exploitation. Collabora, on the other hand, mainly blames GitHub’s CVE-processing backlog, worsened by the growing number of AI-generated reports.

Without a CVE identifier, scanners and vulnerability management processes did not flag the problem. Anyone who updates Nextcloud apps only based on formal advisories was left exposed for weeks.

Impact for European organisations

Nextcloud is widely used in Europe, including by public bodies and companies that prefer to keep their files on their own servers. A web shell on these servers gives access to shared documents and configuration files, and can become a starting point for moving through the internal network.

For entities in scope of NIS2, if a compromise is discovered you need to assess whether the incident is significant. In Italy, in that case, a notification must be sent to CSIRT Italia within the required deadlines. If the server holds personal data, and health data in healthcare, the GDPR data breach obligations also apply.

What to do now

1. Check whether you use the app: look for richdocumentscode among the installed apps. If Collabora runs on a separate server, via Docker or packages, or if you use Nextcloud All-in-One, Collabora says you are not affected.
2. Update to 26.4.303 or later. If you do not need the app, remove it: the vendor warns that disabling it is not enough.
3. Look for signs of compromise from 10 September onwards. Updating does not remove a web shell that is already in place:
   • in the web server logs, check requests to the app’s proxy.php (folder apps/richdocumentscode/), especially after restarts and upgrades;
   • look for PHP files that are not part of Nextcloud in the installation folder and in folders writable by the web server, and use Nextcloud’s integrity checks (occ integrity:check-core and occ integrity:check-app);
   • check for unusual processes and outbound connections of the web server user.
4. If you find traces: isolate the server and change the credentials it holds, starting with the database and the connected services in config.php. Also treat password files and secrets stored on the server or in user storage as compromised. Then assess your notification obligations.
5. Do not rely on CVEs alone: for internet-facing apps, also follow the vendor’s channels (forum, release notes, app store), which in this case gave warnings weeks earlier.

How ARXDOME helps

On computers and servers with the ARXDOME agent, ARX Sentry checks file integrity in the chosen folders: if you include the Nextcloud folders, the appearance of new PHP files becomes an event to analyse. ARX Shield shows open vulnerabilities per machine, highlighting those already exploited, and lets you isolate a suspicious machine from the network. ARX Expose shows which of your company’s services and products are visible from the internet.

Last updated: 15 October 2026