The advisory for CVE-2026-110447 in Nextcloud's built-in Collabora editor landed in October 2026. Attackers had been exploiting it since September 10, a month earlier. PHP webshells, credential harvesting, and in some cases ransomware are the reported outcomes. If you run Nextcloud with the richdocumentscode app, this post explains what is vulnerable, what attackers did, and what you must do.
What CVE-2026-110447 is
CVE-2026-110447 is an unauthenticated OS command injection flaw in the richdocumentscode app, which is Nextcloud's bundled CODE Server (Collabora Online built-in). The flaw sits in the app's proxy.php endpoint. If the bundled Collabora server is not running (after a restart, upgrade, or crash), a malicious request to proxy.php triggers OS command injection with no authentication and no user interaction required. The result is code execution as the web server user on the Nextcloud host.
Who is affected
Nextcloud installations running richdocumentscode versions before 26.4.303 with the built-in CODE server enabled are affected. Standalone Collabora Online servers, Docker and RPM/DEB installs, and Nextcloud All-in-One deployments are not affected. If you are unsure which deployment you have, check whether the richdocumentscode app is installed and enabled in your Nextcloud app list.
What attackers did
Exploitation began around September 10, per administrator reports. Attackers planted PHP webshells on compromised Nextcloud hosts and used them to search for password databases, password manager artifacts, and cryptocurrency wallets. Some administrators reported ransomware deployment, though that element was not independently confirmed. The important detail is the timing: exploitation ran for a month before the advisory and CVE were published. Disabling the app is not sufficient: the vendor explicitly warns that disable-only is not a fix.
What you must do
Upgrade richdocumentscode to version 26.4.303 or later. If you are not using the built-in CODE server, remove the app entirely rather than just disabling it. Because exploitation has been active since September 10, assume compromise on any unpatched instance: look for PHP webshells in your Nextcloud data directory, unexpected admin accounts, and recently installed apps you did not add. Review Nextcloud access logs from mid-September onward for anomalous proxy.php requests.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you need incident response support or a Nextcloud security review.