A One-Click Nextcloud App Was Being Backdoored for Five Weeks Before Anyone Was Told. Turning It Off Does Not Help

Collabora published a security advisory on 14 October for CVE-2026-110447, an unauthenticated operating-system command injection in richdocumentscode — the Nextcloud app listed in the app store as "Collabora Online – Built-in CODE Server." It carries a CVSS v4 base score of 9.2 and is classified as CWE-78. A remote request with no credentials runs a command as the web server user. Every version before 26.4.303 is affected.

The dates are the story. The fix was merged on 9 September. The first attack request administrators have found in their logs arrived on 10 September. Version 26.4.303 shipped on 11 September with release notes that said nothing about security. The advisory came on 14 October. For five weeks the flaw was simultaneously patched and under exploitation, and the only administrators who closed it were the ones who happened to update anyway.

What is affected

The fixed releases require Nextcloud 30 or later. The flaw was reported by the GitHub user wwwshellcodeit, and the advisory was published by Collabora's Caolán McNamara.

Disabling the app is not a mitigation

The advisory is blunt about this:

It is not sufficient to disable the app to avoid the problem; it must be upgraded to >= 26.4.303 or removed.

The vulnerable entry point is a PHP script, proxy.php, that lives in the app's own directory and is served by the web server directly. Nextcloud's record of whether the app is switched on never enters the decision. An administrator who read "critical flaw in an optional app," clicked disable and moved on is still exposed.

The second condition in the advisory deserves the same attention. The attack works in the window when the bundled CODE server is not running — after a container restart, an upgrade, or a crash. The usual intuition is that a service has to be up to be attacked. Here a routine maintenance reboot is the opening, which means the exposure is intermittent and will not reproduce on demand for anyone trying to verify it.

Who this actually hits

CODE stands for Collabora Online Development Edition, the free build Collabora offers for evaluation and small deployments rather than production. Answering on the advisory thread, Collabora's Michael Meeks wrote that "this impacts only the Development Edition." That is accurate, and it understates the exposure.

The built-in CODE server exists precisely because standing up a separate document server is work. It is the one-click choice in the Nextcloud app store, so it is what sits on the installations with no operations team: small charities, schools, departmental file shares, home servers. Those are also the installations least likely to be running Nextcloud 30. On Nextcloud 29 or earlier — already end of life — there is no patched version of the app to install at all. The supported answer is to upgrade the entire platform or delete the app. Anyone who was waiting for a quiet weekend to do a major Nextcloud upgrade is holding an actively exploited remote code execution flaw until then.

The path above the fix is not clean either. Version 26.4.402, released on 24 September, has reportedly failed to start the CODE server or to open documents on some setups, and administrators have rolled back to 26.4.303. The standard instruction is "patch to the latest version." Here the correct instruction is to patch to a specific version and stop.

What to do

Upgrade richdocumentscode to 26.4.303 or later, or remove it. Disabling is not enough.

If the app was below 26.4.303 and reachable from the internet at any point since 10 September, treat the server as possibly compromised rather than assuming it was missed. Administrators reporting attacks on the advisory thread found web shells left in the app's directory under names matching shx*.php; check for them and delete any that are there. Review web server access logs from 10 September onward for requests to the app's proxy endpoint — Collabora's advisory and the public write-ups carry the precise request signatures to search for. Finally, treat everything the web server account could read, including configuration and stored files, as potentially exposed. The cases reported so far did not reach root, which bounds the damage without removing it.

The part that needs fixing upstream

CVE-2026-110447 is a different code path from CVE-2025-66208 in the same proxy, and the advisory states plainly that the earlier fix does not prevent this one. Two unauthenticated-command-injection advisories against the same small script inside about a year is a statement about the design of that component, not about one line in it.

The disclosure gap is the other half of it. The convention that a quietly shipped fix buys administrators time to patch before attackers notice rests on the attackers not having noticed yet. In this case they were already in, the day before the release. A silent patch does not buy time once that is true; it only withholds the one piece of information the defender needed.

Sources: Collabora Online advisory GHSA-g3vx-3m76-fghh, The Hacker News, BleepingComputer, IT-Connect, CVE-2026-110447 record