CVE-2026-110447 Nextcloud Fix: Update or Remove Built-In CODE Server

A Nextcloud server can remain vulnerable to remote command execution even after an administrator disables its built-in Collabora office app. The flaw, tracked as CVE-2026-110447, has been exploited to plant malicious PHP web shells on servers, and the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog on October 23, 2026. With CISA’s remediation deadline for US federal civilian agencies falling on October 26, administrators should check which Collabora deployment they actually run, install the fixed version where possible, and investigate whether an earlier intrusion left behind a backdoor.

Why the CVE-2026-110447 Nextcloud fix needs attention now

CVE-2026-110447 carries a critical severity score of 9.2 under version 4 of the Common Vulnerability Scoring System (CVSS), a framework used to rate the seriousness of security flaws. The issue affects Collabora Online – Built-in CODE Server, the optional Nextcloud app named richdocumentscode that runs a local office-document editing server. Versions before 26.4.303 are affected, according to the vulnerability record. The flaw allows an unauthenticated remote attacker to execute operating-system commands under certain conditions, potentially giving them access to files and other resources available to the web server account.

The timing matters because the vulnerability was already being exploited before its formal public disclosure. In a September 11 report on the project’s issue tracker, a Nextcloud hosting operator described successful intrusions against multiple installations running version 26.4.302. The report included malicious requests targeting the app’s proxy.php endpoint and examples of PHP web shells created on affected systems. The vulnerability was formally assigned its CVE identifier in October, and CISA’s October 23 catalog entry confirmed that it met the agency’s criteria for known exploitation.

CISA’s October 26 remediation date is a binding deadline for covered US federal civilian agencies under the applicable federal vulnerability-management requirements, not a universal legal deadline for every business or home server. Even so, the catalog entry is a strong reason for other organisations to prioritise the fix: exploitation has been documented, and the vulnerable component may be present even when an administrator does not think of it as a separately exposed service.

The flaw appears when the built-in CODE server is not running

The vulnerability is an operating-system command injection flaw. Command injection occurs when software puts attacker-controlled input into a command that the operating system executes, allowing the input to change what the command does. In this case, the vulnerable code path is in the built-in app’s proxy, which handles requests while the local CODE server is unavailable. A restart, upgrade or crash can create that state, making the weakness particularly relevant to server maintenance as well as unexpected outages.

Attackers used crafted HTTP requests to reach proxy.php and inject shell commands, according to the project’s public incident report. Those commands could create PHP files that act as web shells: small backdoor scripts that accept further commands over web requests. Once such a file is accessible, an attacker may be able to run commands with the permissions of the web server process, even if the original vulnerability is later patched.

That last point changes how administrators should respond. A successful exploit is not necessarily limited to the brief period when the vulnerable app is installed or the bundled server is down. If an attacker created a backdoor before the update, the malicious file may continue to work after the original command-injection path has been closed. Patching is essential, but it does not prove that a previously vulnerable host is clean.

Check whether your Nextcloud installation uses the affected app

The vulnerability does not affect every installation that uses Collabora. The affected configuration is specifically the optional Nextcloud app called Collabora Online – Built-in CODE Server, with the app identifier richdocumentscode. The project’s guidance distinguishes it from deployments that connect Nextcloud to a separate Collabora Online server. Standalone Collabora deployments and the vendor-listed Docker and Linux distribution package deployments are not affected by this particular flaw.

Start by checking the installed apps from the Nextcloud administration interface. Look for the full name “Collabora Online – Built-in CODE Server,” and check disabled apps as well as enabled ones. Administrators with command-line access can run the following from the Nextcloud installation directory as the appropriate web-server user:

php occ app:list

Find the richdocumentscode entry and record its version and enabled state. If the app is absent, this specific vulnerability does not apply to that installation. If it is installed below version 26.4.303, treat the instance as affected even if the app is currently disabled. Do not assume that the presence of a separate Collabora server means the built-in app was never installed; check the actual app list.

Update to 26.4.303 or later, or remove the app

The fixed version is 26.4.303. If the app is installed and an applicable fixed release is available for your Nextcloud version, update it promptly through the Apps interface or the command line. The command below asks Nextcloud to update the app:

php occ app:update richdocumentscode

After the operation completes, run php occ app:list again and confirm that the installed version is at least 26.4.303. Do not rely solely on a successful update message; the version check confirms what is installed. If you do not use the built-in CODE server, removing the app is a reasonable way to eliminate this component from the installation.

Administrators running older Nextcloud releases need an additional check. The fix may not be available through the app version supported by an older Nextcloud branch. The project’s guidance for Nextcloud 29 and earlier is to upgrade Nextcloud to a supported version or remove the built-in CODE app rather than continue running an affected release. Do not force an incompatible app package into an older server merely to obtain the newer version number; use a supported upgrade path or remove the vulnerable component.

Preserve evidence before cleaning up a potentially compromised server

If the affected app was installed before the fix, determine whether the server may have been exposed during the exploitation period. Before replacing the app directory, preserve relevant logs and a copy of the app files where operationally possible. Updating or removing the app can overwrite evidence that helps establish whether an attacker already created a backdoor, so an organisation with security staff should coordinate the remediation and investigation rather than treating the update as an isolated maintenance task.

The public incident report identifies several indicators worth checking, including unexpected PHP files in the built-in app directory with names resembling shx*.php or shrf*.php. The report also describes suspicious requests to proxy.php involving encoded path traversal, shell-command substitution and obfuscated commands. These patterns are useful leads for log review, but a matching request alone shows an attempted or suspicious request, not necessarily a successful compromise. Unexpected executable files, failed app-integrity checks or unusual running processes provide stronger reasons to investigate further.

Nextcloud administrators can run an app integrity check and preserve its output before changing the installation:

php occ integrity:check-app richdocumentscode

Review the results alongside web-server access logs and the app directory. Paths vary by installation, so use the actual Nextcloud root and configured log locations rather than copying a file path from another server. If you find an unexplained web shell or other credible evidence of command execution, isolate the affected host from the network and preserve forensic evidence before rebuilding or restoring it. Rotate credentials and secrets that the web server account could access, and assess whether connected systems or stored files may also have been exposed.

What the incident says about patching and recovery

CVE-2026-110447 illustrates the difference between closing a vulnerability and recovering from an intrusion. The fix prevents the documented command-injection path in affected versions, but it cannot remove a web shell planted earlier or tell an administrator whether an attacker accessed readable files. That is why the right response has two parts: establish that the installed app is no longer vulnerable, then investigate the period when the vulnerable code was present.

For organisations subject to CISA’s federal requirements, October 26 is the immediate compliance date to track. For everyone else running Nextcloud, the practical priority is the same: identify richdocumentscode, confirm the installed version, update it to 26.4.303 or later or remove it, and review evidence from any period of exposure. A disabled app is not a clean bill of health, and a successful patch is not proof that an earlier attacker left nothing behind.