CVE-2026-110447 (CVSS 9.2): Nextcloud Collabora CODE Server Pre-Auth RCE Exploited — Upgrade Immediately

If your organisation runs Nextcloud for file collaboration — and tens of thousands of enterprises worldwide do — there is an unauthenticated remote code execution flaw actively being exploited right now, and simply disabling the app will not protect you. CVE-2026-110447 is a pre-authentication OS command injection in the Collabora Online Built-in CODE Server for Nextcloud, rated CVSS 9.2, and attackers have been quietly backdooring servers since mid-September 2026, a full month before the formal advisory landed on 14 October. If you upgraded your Nextcloud recently, restarted your server, or experienced a CODE server crash — your window of exposure may already be open.

Why Nextcloud? Why Now?

Nextcloud is the dominant self-hosted collaboration platform for enterprises that want control over their data — universities, government agencies, healthcare providers, and privacy-conscious tech firms. Its popularity surged when organisations began migrating away from Microsoft 365 and Google Workspace following data-sovereignty regulations in Europe and, increasingly, in India after the Digital Personal Data Protection Act tightened vendor accountability obligations.

The optional Collabora Online Built-in CODE Server (the richdocumentscode app) adds a LibreOffice-powered office suite directly inside Nextcloud — allowing teams to co-edit documents, spreadsheets, and presentations without leaving the platform. It is installed on a significant fraction of production Nextcloud deployments. And it is exactly this app that carries the critical flaw.

What makes this breach window particularly dangerous is the gap between exploitation start and public disclosure. Attackers had five weeks of silent hunting before defenders were formally alerted. Organisations that patched Collabora on release day — 11 September 2026 — were protected, but those who delayed, or who run the now-superseded version 26.4.402 (which introduced a regression causing the CODE server to fail to start, ironically extending the exposure window), remained vulnerable well into October.

Technical Breakdown: How CVE-2026-110447 Works

The flaw is an OS command injection (CWE-78) residing in /apps/richdocumentscode/proxy.php. The proxy script is responsible for forwarding requests to the local CODE server process. Its fatal design flaw: it constructs a Bash command string by embedding attacker-controlled request data inside double quotes, without sanitisation.

An attacker sends a specially crafted unauthenticated GET request to:

GET /apps/richdocumentscode/proxy.php?status=... HTTP/1.1

The status parameter value is placed into a double-quoted shell string, meaning a payload like $(base64 -d <<<BASE64PAYLOAD | bash) executes with the privileges of the web server process. Since the CODE server runs as the web server user on most deployments, the attacker immediately gains the same privileges — enough to read Nextcloud’s database credentials, write files anywhere the web server can write, and plant persistent PHP web shells.

The Trigger Condition — and Why It Matters

There is one critical nuance: the vulnerability is only triggerable when the CODE server process is stopped. When the CODE server is running, proxy.php proxies requests normally. When it is stopped — due to a system restart, a Nextcloud upgrade (which restarts the app), a CODE server crash, or the buggy 26.4.402 regression — the proxy script falls back to a status-check mode that invokes the vulnerable shell path.

This means every routine maintenance window — every Sunday-morning reboot, every Nextcloud update — re-opened the attack window. Attackers appear to have monitored deployment patterns to catch servers immediately after an upgrade or restart.

Critically, because proxy.php is executed directly by the web server, disabling the richdocumentscode app within the Nextcloud admin panel does not remove the script from the filesystem or block web access to it. Disabling is not a valid workaround — only upgrading or physically removing the app directory closes the hole.

Detail	Value
CVE ID	CVE-2026-110447
CVSS v4 Score	9.2 (Critical)
Vulnerability Type	OS Command Injection (CWE-78)
Affected Component	richdocumentscode (Collabora Online Built-in CODE Server) < 26.4.303
Authentication Required	None
Patched Version	26.4.303 (released 11 September 2026)
Advisory Published	14 October 2026
First Known Exploitation	~10 September 2026
NOT Affected	Standalone Collabora Online servers, Docker/RPM/DEB installs, Nextcloud All-in-One

What Attackers Are Doing After Getting In

Post-exploitation behaviour, as reported to BleepingComputer by affected administrators, is methodical and clearly financially motivated:

1. Web shell deployment: Attackers write PHP web shells (typically named with a random shx*.php pattern) into accessible directories, establishing persistent remote access that survives an app update or server reboot.
2. Credential harvesting: They read Nextcloud’s config.php to extract database credentials, then dump users, hashed passwords, and email addresses.
3. Crypto wallet hunting: Scripts scan uploaded files for common wallet formats (.wallet, .dat, Bitcoin Core files) — suggesting a financially motivated threat actor or commodity malware kit.
4. Lateral movement: With database access, attackers can pivot to connected services, impersonate users, or plant malicious documents for further social-engineering attacks against an organisation’s staff.

As of the advisory date, The Hacker News reported at least three confirmed compromises. The actual number is likely higher — web shell-based compromises are often discovered weeks or months after the fact, if ever.

India Context: Why This Hits Closer to Home

India’s enterprise adoption of Nextcloud has accelerated sharply over the past two years, driven by government mandates favouring domestic or self-hosted solutions in sectors including defence, finance, and healthcare. Several state government departments, public sector undertakings, and private hospitals run Nextcloud deployments. The Collabora CODE app is frequently enabled as it provides the only way to offer document collaboration without a separate server infrastructure.

Under the Digital Personal Data Protection Act 2023, organisations that suffer a personal data breach face mandatory notification obligations to the Data Protection Board. A Nextcloud server typically stores a significant volume of sensitive personal data — employee records, client documents, financial reports. A successful web shell compromise almost certainly constitutes a notifiable incident under DPDPA and could trigger significant liability.

This is compounded by the typical Indian enterprise network architecture: Nextcloud servers are often reachable over the public internet (or through a VPN that trusts the internal network broadly), with minimal lateral-movement controls between the collaboration server and core infrastructure. A breach of a Nextcloud server can be a stepping stone into ERP systems, HR platforms, and financial applications. This is precisely the kind of scenario that zero-trust network segmentation is designed to contain.

What You Should Do — Right Now

This is a CVSS 9.2, pre-authentication, actively exploited RCE. Treat it accordingly. Here is your action checklist, in priority order:

1. Determine if you are affected. Check whether you have the richdocumentscode app installed in your Nextcloud instance. Go to Settings → Apps → Installed apps and look for “Collabora Online – Built-in CODE Server”. If it is present, check the version.
2. Upgrade immediately. Update richdocumentscode to version 26.4.303 or later. If you are running 26.4.402 and experiencing the regression (CODE server failing to start), upgrade to the latest available release in the 26.4.x line.
3. Do NOT just disable the app. Disabling the app in the Nextcloud admin panel does not remove proxy.php from the web server’s accessible path. You must either upgrade to 26.4.303+ or remove the app entirely from the filesystem.
4. Scan for web shells immediately. Even if you have now patched, check whether you were already compromised. Search for files matching the pattern shx*.php, starting in the /apps/richdocumentscode/ directory and recursively through all Nextcloud-writable paths. Any unexpected PHP file in that directory should be treated as a web shell and removed.
5. Audit your Nextcloud logs. Look for unexpected GET requests to /apps/richdocumentscode/proxy.php with unusual query strings, especially anything containing Base64, dollar signs, or URL-encoded characters that look like shell metacharacters.
6. Rotate credentials immediately if you suspect compromise. Nextcloud database credentials, LDAP/AD bind credentials, SMTP passwords, and OAuth tokens stored in config.php should all be rotated as a precaution.
7. Segment your Nextcloud server. Ensure that your Nextcloud host cannot reach internal databases, Active Directory servers, or other core infrastructure on broad firewall rules. If you are using self-hosted collaboration tools alongside CI/CD pipelines, confirm that lateral movement from one to the other is blocked.
8. Apply WAF rules. If you front Nextcloud with a web application firewall (FortiWeb, Nginx WAF, ModSecurity), deploy a rule that blocks requests to proxy.php containing shell metacharacters ($, backticks, semicolons) as an additional layer.

Frequently Asked Questions

We don’t use Collabora — are we affected?

Only if you have the richdocumentscode app installed. The core Nextcloud platform and standalone Collabora Online deployments (Docker, RPM/DEB, or Nextcloud All-in-One) are not affected. Double-check your installed apps list — the app may have been enabled by a previous administrator or during initial setup, even if no one actively uses it.

We installed the patch on September 11. Are we safe?

Yes, if you installed richdocumentscode 26.4.303 on or before 10 September 2026 and did not subsequently downgrade or install the buggy 26.4.402 release. Verify your current version in the Nextcloud admin panel and still carry out the web shell scan as a precaution — the first logged attack was around 10 September, so early patchers were narrowly ahead of the campaign.

How do I know if my server was already compromised?

Look for web shell files (shx*.php or any unexpected PHP file) in the apps/richdocumentscode/ directory, review web server access logs for anomalous requests to proxy.php, and check Nextcloud’s config.php modification timestamp. If in doubt, perform a full incident response: take a forensic snapshot, reset all credentials, and bring the server back from a clean backup. Zero-trust segmentation principles — limiting what a compromised collaboration server can reach — significantly reduce the blast radius of any web shell exploitation.

What’s the difference between disabling and removing the app?

Disabling the app in the Nextcloud admin panel sets a flag in the Nextcloud database telling the platform not to load the app’s PHP code during normal requests. It does not remove the app’s files from the filesystem. The vulnerable proxy.php script is served directly by the web server, bypassing Nextcloud’s application layer entirely — so the database flag is irrelevant to the attack path. Removing the app (via the Nextcloud updater or by deleting the apps/richdocumentscode directory) physically removes the script. Upgrading achieves the same result more safely.

---

If you are running Nextcloud in your organisation — in India or anywhere else — this vulnerability demands immediate action. A CVSS 9.2 pre-authenticated RCE that has been exploited for over a month is not a “schedule it for next week” item. It is a patch-now, check-for-compromise, segment-your-infrastructure item.

My team at P J Networks has been deploying layered defences against self-hosted platform RCE vulnerabilities for organisations across Delhi NCR and beyond. If you need help assessing your Nextcloud exposure, deploying WAF rules, or implementing zero-trust segmentation that limits what an exploited server can reach — reach out for a security assessment. The time to act on CVE-2026-110447 is now, not after you find the web shell.