Nextcloud servers have been quietly backdoored through an office app since September. Update it or remove it

Some Nextcloud servers have had a web shell on them since September. Attackers used a bug in Collabora Online – Built-in CODE Server, the optional app that lets Nextcloud edit documents without a separate Collabora server, to run commands with no login.

Collabora fixed the code on September 11 but published the advisory and CVE only on Wednesday. If you turned the app off and moved on, that did not close the hole.

Disabling the Nextcloud app does not fix this one. Update it to 26.4.303 or remove it.
The 5-Minute Cyber Brief
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
Email address
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.

Attackers planted web shells through a Nextcloud office app

The bug, CVE-2026-110447, is an OS command injection in the app’s proxy.php script, rated 9.2. The CVE record says it was “exploited in the wild in September and October 2026.” It only works while the app’s local document server is not running, such as during a restart, an upgrade or after a crash.

Three administrators reported attacks on the project’s GitHub issue tracker. According to The Hacker News, the first logged attack came on September 10. On one server the attacker used the shell to search for password vaults and cryptocurrency wallet files. None of the reports show the attacker getting root.

Collabora’s advisory says: “It is not sufficient to disable the app to avoid the problem; it must be upgraded to >= 26.4.303 or removed.”

Nextcloud servers running the Built-in CODE Server app

Only Nextcloud servers with the Built-in CODE Server app (package name richdocumentscode) installed, at version 26.4.302 or older, are affected. Standalone Collabora Online servers are not, and neither are setups that run Collabora in Docker, from a Linux package or at a hosting provider.

The fixed app needs Nextcloud 30 or later. Nextcloud 29 and older are end of life and the app store still serves them an affected version, so those servers have to upgrade Nextcloud or drop the app. Anything the web server account can read should be treated as possibly exposed.

Update the app to 26.4.303 or remove it

In Nextcloud’s app list, find Collabora Online – Built-in CODE Server. Update it to 26.4.303 or later, or remove it.
On Nextcloud 29 or older, upgrade Nextcloud or remove the app.
Look for shx*.php files, starting in apps/richdocumentscode, and delete them after saving copies for investigation.
If you find a shell, rotate the passwords and keys the web server account could read, including the Nextcloud database password.

Forward this

For whoever runs our Nextcloud server: attackers have been planting web shells through the optional Collabora Built-in CODE Server app since September. Disabling the app is not enough. Can you check whether it is installed, update it to 26.4.303 or remove it, and look for stray shx*.php files in the app folder?

Details

CVE-2026-110447: OS command injection in richdocumentscode proxy.php, CVSS 4.0 score 9.2. Affects all versions before 26.4.303. Different from CVE-2025-66208. CVE and advisory published October 14, 2026.
Fixed: 26.4.303 (released September 11, 2026), which requires Nextcloud 30 or later. The Hacker News reports that some administrators had trouble with 26.4.402 and went back to 26.4.303.
Exploitation: first logged attack September 10, 2026; three administrators reported compromises. Not in CISA KEV as of October 14.

Hunt / verify

Web server access logs back to September 10 for /apps/richdocumentscode/proxy.php?status requests whose path contains %2e%2e, $( or ${IFS}.
PHP files under the app folder that are not part of the release, such as shxa35d0.php or shx5cf91.php. Nextcloud’s integrity check flagged one in a reported case.
Failed sudo attempts by the web server account, and connections to webhook[.]site or from 139.28.18[.]122 and 89.38.98[.]50.

Slack paste: Nextcloud: Collabora Built-in CODE Server app (richdocumentscode) CVE-2026-110447 exploited since Sept 10, no login. Disabling is not enough. Action: update to 26.4.303+ or remove the app, hunt for shx*.php in apps/richdocumentscode, check proxy.php?status in access logs.

Sources

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].