Who is affected
The flaw sits in the "Built-in CODE Server" of Nextcloud's Collabora Online integration, shipped as the richdocumentscode app. This is the mode where Nextcloud downloads and runs a local Collabora AppImage so you do not need a separate document server. Standalone Collabora servers are not affected, according to the reporting by Security Affairs.
CISA (the US Cybersecurity and Infrastructure Security Agency) added CVE-2026-110447 to its Known Exploited Vulnerabilities (KEV) catalog on 23 October 2026. The CISA alert names Collabora Online's built-in CODE Server and describes the bug as operating system command injection. It lists no remediation deadline for this entry. Security Affairs reported a federal due date of 26 October; treat that as unconfirmed, because the CISA page itself does not show one.
| Field | Value (as of 25 October 2026) |
|---|---|
| CVE | CVE-2026-110447 |
| Score | CVSS 9.2 (critical), as reported by Security Affairs |
| Affected | richdocumentscode up to and including 26.4.302 |
| Fixed | 26.4.303 |
| Type | OS command injection in proxy.php, no login needed |
| CISA KEV | Added 23 October 2026 |
| Exploited | Yes, since at least 10 September 2026 |
The attack started six weeks before the KEV listing
The useful part of this story is the timeline, because the public record is a GitHub issue rather than a vendor press release.
- 10 September: the first logged attack, per Security Affairs.
- Mid September: administrators opened issue 354 on the
CollaboraOnline/richdocumentscoderepository. One said several of their Nextcloud servers had been entered through a web shell. Another found out because Nextcloud's own integrity check flagged an unexpected file, and a third because of failed-sudo alerts on the server. - 14 September: project maintainer mmeeks confirmed 26.4.303 as the fix. In the thread, mmeeks wrote "Please do upgrade."
- 18 September: mmeeks added "It is important to upgrade to the latest 26.4.303, and also to remove any lingering shx*.php files".
- 14 October: the issue was closed and linked to GitHub advisory GHSA-g3vx-3m76-fghh.
- 23 October: CISA added the CVE to KEV.
So a fix has been available for more than five weeks. Anyone who updated promptly is likely fine on the code side, but the web shells left behind by earlier attacks survive an update. That is why the cleanup step matters as much as the patch.
How the attack works
Per the reports, an unauthenticated attacker can exploit the bug only while the built-in server is not running, for example during a restart, an upgrade or after a crash. The attacker sends a request to /apps/richdocumentscode/proxy.php?status with path traversal (%2e%2e) and shell syntax such as $(...) and ${IFS} in the URL. The payload decodes a base64 string and pipes it to a shell.
The admins in the thread then saw PHP web shells with names like shx13a86.php and shxa35d0.php. The shell code they posted is a single line that runs whatever command arrives in a c parameter. One administrator said the attacker ran discovery commands aimed at password-manager and cryptocurrency-wallet files. Security Affairs says the number of compromised servers is unknown.
Two source IP addresses and a callback to a webhook.site address appear in the thread. Treat them as leads for your own log search, not as a complete list, since attackers rotate infrastructure.
What to do in the next 24 hours
- Check your version. In the Nextcloud admin Apps page, or from the command line:
sudo -u www-data php occ app:list | grep -i richdocumentscode
- Update to 26.4.303 or later, from the Apps page or with:
sudo -u www-data php occ app:update richdocumentscode
- Look for leftover web shells. Adjust the path to your install:
find /var/www/nextcloud -name 'shx*.php' -ls
sudo -u www-data php occ integrity:check-core
- Search web server logs for requests to
richdocumentscode/proxy.phpcontaining%2e%2e,base64or${IFS}. - If anything turns up, treat it as a compromise. Security Affairs advises treating data readable by the web server account as potentially exposed. That means rotating database credentials, the Nextcloud secrets in
config.php, and any passwords or keys stored on that host.
One caution from the thread: a user who upgraded to 26.4.303 with the app still enabled reported that related requests continued and processes kept trying to create shx*.php files. The thread does not resolve it, and mmeeks said a scary-looking process listing "should be harmless". If you see this, check that no shell files were actually written, and consider disabling the app until you have confirmed a clean state.
Why small Nextcloud installs are the exposed group
The built-in server exists to make self-hosting easy, so it tends to run on small single-server installs at agencies, schools and clinics, often with no one watching logs. Those are the places where a September compromise could still be sitting unnoticed. A switch to a separate, standalone Collabora server removes this specific exposure, since that setup is reported as unaffected.
Your Nextcloud decision before Monday
Check the installed richdocumentscode version today. If it is 26.4.302 or older, update and run the file search before anything else. If you cannot do that today, disable the app until you can. If you find a shx*.php file, switch to incident response rather than just deleting it.
