Nextcloud built-in CODE Server attacks: what CVE-2026-110447 exposed and who needs to act

The reported intrusions

A Nextcloud administrator reported on 11 September 2026 that several installations using Collabora Online Built-in CODE Server had been compromised. The installations were running the richdocumentscode app at 26.4.302. The reporter supplied web access logs, described newly created PHP webshells, and said one webshell was subsequently used to search for credential and cryptocurrency-related artefacts. A second administrator said a similar PHP file appeared on their installation. This is more than a hypothetical vulnerability report, but it is still evidence from the affected administrators, not a census of all installations.

The later CVE-2026-110447 advisory describes an OS command-injection issue in proxy.php when the CODE server is not running. Its GitHub record is unreviewed. The reporter's logs and a maintainer's public comments are the strongest sources for the observed impact and practical scope; they should not be blended into a claim that every Collabora Online deployment was exposed.

The deployment boundary matters

In the maintainer's response, Michael Meeks said the problem impacts only the Development Edition and only a comparatively uncommon Built-in CODE Server deployment mode that downloads a local AppImage. Another maintainer directed users to 26.4.303; Meeks later said that version ‘should be good’. The public advisory's structured affected-version fields are not a complete version matrix, so the precise claims supported here are the reporter's affected 26.4.302 installation and the maintainers' 26.4.303 recommendation.

A Nextcloud site using a standalone Collabora service should not be automatically treated as the same exposure. Conversely, an administrator should not assume that a patch removes a webshell already written to disk. The first question is which CODE deployment mode the installation actually runs; the second is whether there are signs of pre-upgrade compromise.

Deployment and evidence boundaries. These rows are not an estimate of prevalence.

Scenario	What the public record supports	Operational implication
Development Edition built-in CODE Server downloading a local AppImage	Maintainer explicitly identifies this mode as affected	Prioritise upgrade and investigate for compromise
Version 26.4.302 in that mode	Reporter names this version on compromised installations	Treat a previously exposed host as a possible incident
Version 26.4.303	Maintainers recommend it and say it should be good	Update, then verify integrity and investigate historical exposure
Standalone Collabora Online service	Not the deployment mode identified by the maintainer	Check its own advisories and configuration; do not generalise this case

What the logs show about the attack path

The administrator's evidence identifies requests aimed at the built-in server's proxy.php?status endpoint. The paths used encoded traversal and shell-substitution syntax; the supplied analysis says a decoded shell payload wrote PHP webshell files. Subsequent requests tested webshell paths, and one affected host recorded commands searching for password-manager databases and cryptocurrency wallet material. The advisory's command-injection description is consistent with that sequence, but the public record does not provide an independently verified, complete exploit-to-impact reconstruction for every installation.

The key trust boundary is a request-controlled value reaching a server-side command path. The attacker did not need to change a document to create the reported webshell. Once a PHP webshell runs as the web-server account, the attacker may act with whatever filesystem and application-data access that account has. The reported HTTP review found no explicit archiving, upload or exfiltration commands. That does not prove data remained confidential; it limits what can be claimed from the available logs.

TTPs in the administrator's report, separated from what remains unproven.

Stage	Observed or reported evidence	Limit
Entry	Requests to the built-in CODE Server proxy status path with encoded traversal and command-substitution syntax	The full population of exposed installations is unknown
Execution	Reporter describes decoded shell content and creation of PHP webshell files	Do not infer the exact commands used on other hosts
Persistence / access	Repeated requests checked whether generated webshell paths responded	Public logs do not establish duration of access across all hosts
Discovery	One host showed searches for credential and cryptocurrency artefacts	A search is not proof that files were found or stolen
Exfiltration	No explicit file upload or archive commands in the reviewed HTTP requests	Other channels or missing logs cannot be excluded

What administrators should do now

Inventory Nextcloud installations with the richdocumentscode app and identify whether they use the built-in Development Edition mode described by the maintainer. Upgrade affected instances to 26.4.303 or later, following vendor guidance. For systems exposed before the upgrade, preserve access, application and filesystem evidence before cleaning up. Review web-server logs for unusual requests to the CODE Server proxy endpoint; inspect the app directory for unexpected PHP files and verify app integrity. Look for anomalous outbound requests and process execution by the web-server account.

If a webshell or other compromise indicator is found, respond as an incident rather than as a routine update. Contain the host, determine the web-server account's access to Nextcloud data and secrets, rotate credentials within that scope, and restore from a trusted state as warranted. Removing a suspicious file does not establish that no other changes were made. Administrators of standalone Collabora deployments should follow advisories for their own service rather than assuming this built-in app report is their exposure.

The September reports and the October advisory are different records

The original administrator report describes attacks against multiple Nextcloud installations using richdocumentscode 26.4.302 on 10–11 September. A second administrator reported a similar webshell on 11 September. Maintainers responded on 14 September: one said 26.4.303 appeared to contain the fix, while another narrowed scope to Development Edition in the built-in CODE Server mode that downloads a local AppImage and advised an upgrade. The latter later replied that 26.4.303 should be good. The GitHub advisory, assigned CVE-2026-110447, was published on 14 October.

That timeline matters because the exploitation report is older than the CVE entry. A CVE publication date is not the start of the attack, and a reported attack against 26.4.302 is not evidence that all Nextcloud or standalone Collabora installations were vulnerable. The advisory says the command-injection path is in proxy.php when the CODE server is not running, such as after a restart. It also says the standalone Collabora Online server is outside this vulnerability. Its structured 'Affected versions' and 'Patched versions' fields remain Unknown, despite the description and maintainers pointing to 26.4.303. An operator should therefore verify the app build and vendor guidance rather than relying on a package scanner's empty version fields.

Source chronology and the strength of each claim.

Date	Public record	Editorial reading
10–11 Sep	Administrator reports exploit requests and created PHP webshells on 26.4.302 installations	Observed compromise in reported systems, not a universal victim count
14 Sep	Maintainers advise upgrade; 26.4.303 described as the safe version for the scoped mode	A product-specific upgrade recommendation
14 Oct	GitHub advisory publishes CVE-2026-110447 with critical severity	Later formal identifier; structured version fields still Unknown

An upgrade closes the route; it does not remove an earlier webshell

The most important operational distinction is between vulnerability remediation and incident recovery. In the issue thread, an administrator who upgraded to 26.4.303 still saw processes attempting to create shx*.php files after an HTTP request. A maintainer advised upgrading and removing lingering webshell files, and said the process output looked alarming but should be harmless because it pointed to an invalid font server. That is a maintainer interpretation of the later behaviour, not proof that an already deployed webshell vanished or that every prior action was reversed.

The first reporter recovered webshells on multiple servers and observed one shell used to search for password-manager databases and cryptocurrency wallet material. The reviewed HTTP requests did not explicitly show archiving, upload or exfiltration commands. That limits what can be claimed about data theft. Yet a working webshell could access material available to the web server account, so affected operators should preserve evidence and assess exposure of application secrets and accessible data. The absence of an exfiltration command in one reviewed log set cannot prove no disclosure occurred through another path or unretained period.

Separate patch verification from compromise assessment for the built-in CODE Server deployment.

Question	Check	Interpretation
Was the vulnerable mode deployed?	Confirm Development Edition built-in CODE Server and local AppImage use	Standalone Collabora Online is outside the advisory scope
Was a vulnerable build present during exposure?	Record richdocumentscode version history, especially 26.4.302	Current 26.4.303 does not erase an earlier attack window
Did exploitation reach the host?	Preserve access logs, integrity alerts, `shx*.php` files and process history	A webshell or follow-on command warrants full incident response
Could application data have been read?	Map PHP service-account privileges, Nextcloud secrets and file access	Search activity is observed; exfiltration remains unproven in published logs

Sources and provenance

The administrator's logs and impact account, the second administrator's corroborating report, and the maintainer's scope and upgrade advice are in CollaboraOnline issue #354. The GitHub CVE-2026-110447 entry supplies the advisory description and is marked unreviewed. Read 16 October 2026. The defensive steps above are our assessment of the reported mechanism and should be adapted to each deployment.