Key points
- CVE-2026-110447 affects richdocumentscode app versions before 26.4.303
- Exploitation requires the built-in CODE server to be stopped or restarting
- Web shells have been found on compromised servers since September 2026
Attackers can execute operating system commands on Nextcloud servers without logging in, gaining persistent access through web shells. This capability stems from a command injection flaw in the Collabora Online Built-in CODE Server app, tracked as CVE-2026-110447. The vulnerability allows remote exploitation under specific conditions, turning routine server maintenance into a critical security risk for managed service providers overseeing Nextcloud deployments.
In plain English
The flaw resides in a file called proxy.php, which manages communication for the built-in document server within Nextcloud. When a malicious request reaches this code while the server process is inactive, the application interprets part of the request as a system command. This allows an attacker to run instructions with the permissions of the web server user, bypassing standard authentication entirely.
The background
According to Cyber Security News, users reported finding web shells on their servers in October 2026. The GitHub Advisory Database confirms that exploitation occurred during September and October 2026. The issue carries a CVSS v4 score of 9.2, classified as high severity. It is distinct from CVE-2025-66208, meaning previous patches do not protect against this specific attack vector.
What changes now
Standalone Collabora Online servers remain unaffected; the risk is limited to Nextcloud instances using the built-in CODE Server app. As RedTeam Log reported on 2026-10-14, similar restart-based injection flaws have previously enabled full system control. Administrators must now treat server restarts and upgrades as high-risk windows where unauthenticated command execution is possible if the vulnerable code path is exposed.
The attacker's path
Attackers targeting this class of vulnerability typically look for services that restart frequently or run in containerised environments. The weakness relies on a race condition or state mismatch where the application accepts input before the backend service is ready. This technique serves the initial access phase of an intrusion, allowing threat actors to bypass authentication controls entirely. Teams usually monitor for unexpected process spawns or outbound connections from web server accounts to detect such activity early.
What to do and how to stay safe: Nextcloud
- Verify that your Nextcloud instances are running richdocumentscode version 26.4.303 or later to mitigate this specific injection flaw.
- Monitor server logs for unusual command execution patterns during maintenance windows, particularly when the CODE server is restarting.
- Scan file systems for newly created PHP files or scripts that do not belong to the standard application directory structure.
- Review access logs for requests to proxy.php that occur when the backend service is not actively running.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this vulnerability affect standalone Collabora Online installations?
No, the flaw only affects the Collabora Online Built-in CODE Server app within Nextcloud deployments.
Is this the same issue as CVE-2025-66208?
No, Collabora confirms this is a different attack path, and the previous fix does not block this exploit.
What permissions do the executed commands have?
Commands run with the permissions of the web server user, not automatically as root.
