Attackers have been planting web shells on Nextcloud servers by abusing an optional document-editing app rather than Nextcloud itself. The flaw is CVE-2026-110447, an OS command injection in the Collabora Online Built-in CODE Server app, and the CVE record states it was exploited in the wild during September and October 2026.
What happened
The app, published as richdocumentscode, downloads a copy of Collabora Online Development Edition and runs it on the Nextcloud server. Its proxy.php hands requests to that local document server, and when the server is not running, typically during a restart, an upgrade or after a crash, an unauthenticated request can slip a command through instead.
The planted file is a plain PHP script sitting in the app folder that the web server executes directly, loading none of Nextcloud's own code. Collabora rated the flaw 9.2 under CVSS 4.0 and fixed it in 26.4.303. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of 26 October 2026.
Collabora's advisory is blunt about the easy answer: switching the app off is not enough. It has to be upgraded or removed, because the leftover script stays executable in the app directory.
Who is affected
Self-hosted Nextcloud deployments that installed the built-in CODE Server app instead of pointing at a standalone Collabora server.
- Every version of richdocumentscode before 26.4.303 is affected.
- Standalone Collabora Online servers are not affected, and neither are Nextcloud instances without this app.
- Nextcloud 29 and older are end of life, and the app store still serves them the vulnerable version, so those deployments need a Nextcloud upgrade or removal of the app.
- The earlier fix for CVE-2025-66208 in the same script does not cover this flaw.
What to do now
Update richdocumentscode to 26.4.303 or later, or remove the app entirely, then hunt for the web shell it may have left behind.
- Check the installed version under Apps in Nextcloud, not the version in the app store listing.
- Inspect the app directory for unexpected PHP files, particularly any script that loads no Nextcloud bootstrap code.
- Review web server logs for requests to the app's proxy.php while the document server was restarting.
- If you find a shell, treat the file server as compromised: rotate admin and service credentials and check for scheduled tasks or SSH keys added after the shell appeared.
What this means for South African businesses
Nextcloud is a popular way for local firms to keep file sharing in-house and out of a hyperscaler, and the built-in CODE app is the convenient way to get document editing without standing up a second server. That convenience is what turned an optional app into a backdoor. My judgement is that few self-hosted Nextcloud operators scan their app directories, so shells planted weeks ago will still be there when the patch lands, which makes the post-patch hunt more important than the patch itself.
Source: The Hacker News.
Also on the blog
- PHP2Shell: CVE-2026-109618 RCE confirmed on a live PHP 8.4.26 server
- Magento loader: 953 online stores hit, and deleting the script is not a fix
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.