Nextcloud CODE app flaw exploited to plant web shells

Attackers have exploited CVE-2026-110447, a critical flaw in Nextcloud's built-in Collabora CODE server app, to plant web shells on servers since September 10, 2026. The app, called richdocumentscode, lets a request with no login run commands on the server. Turning the app off does not help. Admins must update it to version 26.4.303 or remove it, and then check for a break-in.

Nextcloud is a self-hosted platform for sharing files and working on documents. Collabora Online is an office suite that edits documents in the browser. Its CODE edition can run inside Nextcloud through this app, so admins do not need a separate document server. A web shell is a small script an attacker leaves on a server to run commands through a web browser.

How the attack works

The bug sits in the app's proxy.php file. "A request can cause an operating system command to run as the web server user," the Collabora security advisory says. It needs no password and no click from a user, and it scores 9.2 out of 10 on the CVSS 4.0 scale.

There is one condition. The attack works only while the built-in CODE server is not running, such as during a container restart, an upgrade or after a crash. The Hacker News explains why. When nothing is listening, any request starts the local CODE server. Up to version 26.4.302, the app put text from that request inside a shell command, so an attacker could slip in a command of their own.

Once inside, the attackers dropped small PHP files. According to BleepingComputer, the web shells were used to search for password databases, password manager files and crypto wallets. Some users reported ransomware, which BleepingComputer could not confirm. The Hacker News counts three administrators who reported break-ins and found no reports of attackers gaining root.

A fix shipped before the warning

The fix existed before the attacks began, but nothing marked it as a security fix. The Hacker News lays out the dates:

Date (2026)	What happened
August 20	Collabora's Caolán McNamara writes the fix
August 31	Version 26.4.302 ships without it
September 9	The fix is committed
September 10	First logged attack, at 19:51 UTC+2
September 11	Version 26.4.303 ships with the fix
October 3	A forum member warns the flaw is "already being exploited"
October 14	The CVE and the advisory are published

Collabora blamed the late disclosure on GitHub's CVE-processing backlog, BleepingComputer reports. For more than a month, admins who read only release notes had no reason to rush the update.

Who is affected

Only Nextcloud servers that use the Built-in CODE Server app are exposed. Standalone Collabora Online servers are not affected, the advisory says. The Hacker News adds that the Nextcloud Office app without the built-in component is also safe. A Collabora developer posting as mmeeks said the bug "impacts only the Development Edition, and only in this (rather rarer) Built-in CODE Server deployment mode." The Nextcloud app store describes the app as meant "for local testing and non-production use."

Older servers are a harder case. The fixed app needs Nextcloud 30 or newer. Nextcloud 29 and earlier are out of support, so the advisory says those admins should upgrade Nextcloud or remove the app. This is also a different flaw from CVE-2025-66208, and that earlier fix does not stop it.

What this means for developers

Check your Nextcloud apps list for "Collabora Online - Built-in CODE Server" today. If its version is below 26.4.303, update it or remove it. The advisory is blunt that disabling is not enough: it "must be upgraded to >= 26.4.303 or removed." The Hacker News notes that version 26.4.402 fails to start on some setups, and some admins went back to 26.4.303.

Then look for signs of a break-in, because the attacks began before most admins knew. The Hacker News suggests these checks:

Look for files named shx*.php in apps/richdocumentscode/, such as shxa35d0.php, and delete them.
Search web server logs back to September 10 for requests to proxy.php?status that contain $( or ${IFS}.
Look for sudo attempts by the web server user.

If you find a shell, treat every secret the web server user could read as exposed, and rotate it.

The longer lesson is about silent fixes. A changelog without a security note is not proof that an update is optional. Watch the GitHub security advisories for each app you self-host. For production use, run a standalone Collabora Online server, since the built-in app was never meant for it.

This article was first published on Tech AI Wire.