Attackers have exploited a command-injection flaw in Nextcloud’s Collabora Online – Built-in CODE Server app, according to the CVE Program record. The opening is unusually specific: the app’s proxy.php can run attacker-influenced commands as the web-server user while the built-in CODE server is stopped. That can happen during a server restart, an upgrade or a crash. The affected app is richdocumentscode before 26.4.303; a standalone Collabora Online server is outside this scope.
CISA’s October 23 KEV entry for CVE-2026-110447 puts federal agencies on an October 26 remediation timetable. Collabora published its advisory on October 14; the CVE record dates exploitation to September and October. If your Nextcloud instance has the built-in app installed, the useful first question is which version is actually on the server, including on instances where the app was switched off.
A stopped server opens the path
The Collabora Online advisory describes an unauthenticated operating-system command injection in the richdocumentscode proxy. The proxy sits between Nextcloud and the built-in document server. When that server is not running, a request to proxy.php can cause an OS command to execute as the web-server user. The advisory scores the flaw 9.2 under CVSS 4.0 and names 26.4.303 as the first fixed app release. Its CVSS vector requires no prior privileges or user interaction, so an exposed proxy can be targeted without an account or a document being opened.
A brief downtime window is enough to change which code handles a request. The advisory names a container restart, an upgrade and a crash as examples. It also warns: “It is not sufficient to disable the app to avoid the problem, it must be upgraded to >= 26.4.303 or removed.” Treat an installed but disabled vulnerable copy as still requiring that fix or removal. The earlier CVE-2025-66208 fix addresses a different path, according to Collabora.
Reports of shells on Nextcloud
The CVE Program record calls this flaw exploited in the wild in September and October 2026; CISA’s entry also marks it as known exploited. In an October 3 Nextcloud community thread, a participant said users had found web shells on their servers. Another participant later posted a concrete integrity-scan result: EXTRA_FILE for ./apps/richdocumentscode/Nx_33143.php, describing the file as a backdoor.
The same community warning separates deployments: a Nextcloud instance using richdocuments without richdocumentscode, a separate Docker or distribution-packaged Collabora server, and hosted Collabora are outside the built-in app path described there. Compare installed apps, not just whether users edit documents. Collabora’s advisory also says Nextcloud releases 29 and older are end of life; operators of those releases should upgrade Nextcloud or remove the built-in app.
Replace the app, inspect the host
Check the installed richdocumentscode version on each Nextcloud instance. Upgrade the app to 26.4.303 or newer, or remove it where unused. Confirm the installed version or absence after the change. Disabling the app leaves the vulnerable installation in place. For an internet-facing instance, follow CISA’s instruction to evaluate each asset’s exposure and apply the vendor mitigation; federal operators should account for the October 26 action date and CISA’s forensic-triage direction.
If a vulnerable app was present while its CODE server stopped, inspect Nextcloud’s app-integrity results for unexpected PHP files under apps/richdocumentscode/. The reported Nx_33143.php and EXTRA_FILE pairing is one concrete lead. Review web-server access logs for suspicious requests to the app’s proxy.php across server stops and upgrades, and preserve the logs and any unexpected file for incident response. A quiet log or the absence of that particular filename cannot clear a server; the community report describes one observed file, and log retention and collection vary by deployment.
Confirm the fix and investigate exposure
Update or remove the built-in app and verify the resulting installed state. Then use the earlier vulnerable period, server-stop times, Nextcloud integrity findings and web-server logs to decide whether the host needs incident handling. Where a web shell or unexplained PHP file turns up, contain the server and assess credentials available to its web-server user before putting it back into service. Record the version found before the update and the CODE server stop times so responders can correlate proxy.php requests with integrity findings. A fixed app prevents this entry route; unexpected files and suspicious requests call for a separate incident investigation.