Nextcloud and Collabora CODE (CVE-2026-110447): update or remove

Summary

CVE-2026-110447 is an operating system command injection in the proxy.php file of the built-in CODE server (the richdocumentscode app) for Nextcloud. The CVSS 4.0 score is 9.2, and no login is required. It is fixed in app version 26.4.303, released on September 11, 2026.

An important detail

The vulnerability can be triggered when the built-in CODE server is not running. For this reason, disabling the app in the Nextcloud interface does NOT fix the problem. The vendor states this explicitly. Only updating or completely removing the app helps.

Standalone Collabora Online servers are not affected: only the built-in variant is vulnerable.

How to check

sudo -u www-data php /var/www/nextcloud/occ app:list | grep -i richdocuments
sudo -u www-data php /var/www/nextcloud/occ app:get richdocumentscode installed_version

A version lower than 26.4.303 means you are vulnerable.

Updating

sudo -u www-data php /var/www/nextcloud/occ app:update richdocumentscode
sudo -u www-data php /var/www/nextcloud/occ app:get richdocumentscode installed_version

The app requires Nextcloud 30 or later. If you have Nextcloud 29 or older, update Nextcloud itself or remove the app:

sudo -u www-data php /var/www/nextcloud/occ app:remove richdocumentscode

Choosing a version

Version 26.4.303 and later are considered fixed. Version 26.4.402, released on September 24, failed to start for some administrators, and rolling back to 26.4.303 helped; version 26.4.502 was released on October 23. If the app does not start after the update, rolling back to 26.4.303 remains safe: it already contains the fix.

Check for leftover backdoors

Attacks have been observed since about September 10, 2026, and they planted PHP web shells. After updating, the vendor advises deleting any remaining files matching shx*.php.

find /var/www/nextcloud -name 'shx*.php' -ls
find /var/www/nextcloud -name '*.php' -newermt '2026-09-01' -ls | head -50

Any PHP file in data directories or temporary folders that is not part of the distribution calls for investigation, not simple deletion: save a copy and the logs first.

What else to check after updating

1. Nextcloud administrator accounts: look for new ones.
2. App passwords: occ user:auth-tokens:list username.
3. Cron jobs of the web server user.
4. Outbound connections from the server: web shells often connect to external hosts.

Frequently asked questions

I disabled the richdocumentscode app. Is that enough?

No. The vendor states explicitly that disabling the app does not remove the vulnerability. Update or remove the app.

I use a standalone Collabora server, not the built-in one. Am I affected?

Standalone Collabora Online servers are not affected by this vulnerability.

Does a reverse proxy in front of Nextcloud protect against CVE-2026-110447?

No: the request passes through the proxy to the app. Only updating protects you.

How do I know if my Nextcloud server has already been attacked?

Look for shx*.php files, for new PHP files in the Nextcloud directories since September, and for unusual web server log entries with requests to proxy.php.