Nextcloud richdocumentscode command injection flaw enables web shell deployment during server restarts
Attackers are exploiting CVE-2026-110447 to install web shells on Nextcloud servers running the Collabora Online Built-in CODE Server app.
Key points
- CVE-2026-110447 is a high-severity command injection flaw in the richdocumentscode app before version 26.4.303.
- Exploitation requires the built-in CODE server to be stopped, creating a window during restarts or crashes.
- Attackers have deployed web shells to maintain access, according to user reports on the Nextcloud community forum.
Remote attackers are exploiting an unauthenticated command injection vulnerability in the Nextcloud Collabora Online Built-in CODE Server app. The flaw, tracked as CVE-2026-110447, allows execution of operating system commands without valid credentials. Users reported finding web shells on compromised servers in October 2026, indicating active exploitation of this specific component within Nextcloud deployments.
Root cause
The vulnerability resides in the proxy.php file of the richdocumentscode application. According to Collabora’s security advisory, a crafted request can force the server to execute arbitrary operating system commands as the web server user. This issue is classified as CWE-78, or operating system command injection. The flaw is distinct from CVE-2025-66208, meaning that applying the patch for the earlier vulnerability does not mitigate this new attack vector.
Attack path
Exploitation does not require user interaction or stolen credentials. However, it depends on a specific operational state: the built-in CODE server must not be running when the malicious request arrives. This condition creates an attack window during routine maintenance activities such as container restarts, software upgrades, or service crashes. Commands execute with the permissions of the web server account rather than as root, though the impact on data privacy and integrity remains significant.
Affected versions
- Nextcloud Collabora Online Built-in CODE Server app versions prior to 26.4.303.
- Standalone Collabora Online servers are not affected by this specific vulnerability.
- The flaw is specific to the richdocumentscode app and does not affect other Nextcloud components or desktop clients.
Mitigation
- Update the richdocumentscode app to version 26.4.303 or later immediately.
- Verify that the patch for CVE-2025-66208 has not been mistakenly assumed to cover this issue.
- Monitor for unexpected process execution during server maintenance windows.
Signals worth monitoring
Security teams should examine web server logs for unusual POST requests to proxy.php endpoints, particularly when the application service is restarting. Look for outbound connections from the web server process to unknown external IPs, which may indicate command-and-control communication. Check file system integrity for newly created scripts in web-accessible directories. Review process lists for unexpected shell sessions spawned by the web server user. Isolate compromised hosts immediately to prevent lateral movement while investigating the extent of the breach.
Background: Web shells
Web shells are small scripts that give attackers remote control of your web server. They bypass network firewalls by using legitimate HTTP traffic. Detection requires monitoring for unusual command execution and file changes, not just network signatures. Removal involves identifying the script, isolating the server and restoring from clean backups.
Read the full guide: Web Shells: Detect, Analyse and Remove Hidden Backdoors
What to do and how to stay safe: Nextcloud
- Audit Nextcloud instances for the richdocumentscode app version and upgrade if below 26.4.303.
- Inspect web server logs for suspicious activity during maintenance windows or service restarts.
- Scan for unauthorized scripts or web shells in document directories and temporary folders.
- Restrict network access for the web server user to limit lateral movement potential.
Step-by-step guide: Out-of-band patches: what small businesses need to know
General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does the fix for CVE-2025-66208 protect against this new vulnerability?
No, Collabora confirms that CVE-2026-110447 is a different attack path and the earlier patch does not block this exploit.
Do attackers need a valid Nextcloud account to exploit this flaw?
No, the vulnerability allows remote attackers to run commands without logging in or having any user credentials.
Are standalone Collabora Online servers affected by CVE-2026-110447?
No, the issue specifically affects the Collabora Online Built-in CODE Server app within Nextcloud deployments.
