If you run a self-hosted Nextcloud, there is one optional app to check right now: richdocumentscode, the built-in Collabora CODE server. CVE-2026-110447 is an OS command injection flaw in it, rated CVSS 9.2. It needs no authentication and no user action, and it is exploitable when the built-in CODE server is not running (after a restart, an upgrade or a crash). Attackers have used it to drop PHP web shells, with reported exploitation starting around 10 September 2026.
The fix (26.4.303) shipped on 11 September, but the advisory only went public on 14 October. That gap is why patching alone does not close the question.
Scope: which instances matter
- Affected: Nextcloud servers with
richdocumentscodeolder than 26.4.303. - Not affected, per Collabora: standalone Collabora Online, Docker, RPM or DEB installs, and Nextcloud All-in-One.
- Include test, staging and department servers in the inventory. Those are the ones that miss patch cycles.
Remediation steps
- Update
richdocumentscodeto 26.4.303 or later, or remove the app if nobody uses it. - Do not rely on disabling the app. The vendor says that is not enough.
- Put the server behind a VPN or a web application firewall if it does not need to be public.
- Add every installed Nextcloud app to the monthly patch review, not just core.
Detection: assume September, not October
- Look for unexpected
.phpfiles in the Nextcloud install and app folders. - Review web server logs for unusual requests to
proxy.phpfrom September onward. - If anything turns up, isolate the host and preserve logs before cleaning.
- Rotate admin and service account passwords, API keys and tokens. Reports say attackers searched for password databases, password manager files and crypto wallets.
- In India, check whether the incident falls under the CERT-In six-hour reporting rule.
More detail: Nextcloud CODE server flaw, what to check and report
Written by the team at Affix Center, an IT services company in Lower Parel, Mumbai.
Top comments (0)