Nextcloud richdocumentscode Command Injection Patch Blocks Unauthenticated Remote Code Execution

Nextcloud administrators using the Collabora Online Built-in CODE Server app must update to version 26.4.303 to address a critical security flaw. The vulnerability, tracked as CVE-2026-110447, allows remote attackers to execute operating system commands without authenticating. According to Cyber Security News, users are reporting web shells on servers, indicating active exploitation.

In plain English

The flaw exists in the richdocumentscode app, which runs Collabora’s built-in document server inside Nextcloud. Specifically, the issue is in proxy.php. A crafted request can cause the server to run an operating system command as the web server user. This is classified as CWE-78, or operating system command injection. Attackers do not need an account or user interaction.

The background

Cyber Security News reports that attackers exploited this flaw during September and October 2026. An October 3 warning on the Nextcloud community forum noted that users found web shells on their servers. These malicious scripts allow attackers to run commands and maintain access after the initial break-in. The Github advisory rates the impact on data privacy, file integrity, and service availability as high.

What changes now

Collabora confirms that this is a different attack path from CVE-2025-66208. Installing the fix for the earlier vulnerability does not block this exploit. Standalone Collabora Online servers are not affected by this specific issue. The flaw only impacts the Collabora Online Built-in CODE Server app within Nextcloud deployments.

Who needs to act first

Teams should prioritize updating systems that expose the richdocumentscode app to untrusted networks. Check whether the built-in CODE server is currently running, as exploitation requires it to be down. Roll out the update to production environments only after verifying it in a test environment. Back up server configurations before applying changes. Monitor logs for unusual command execution attempts during the maintenance window. Ensure that maintenance procedures do not leave the server in a vulnerable state for extended periods. Coordinate with development teams to minimize downtime during the upgrade process.

Background: Unauthenticated remote code execution

Unauthenticated remote code execution often stems from default credentials, exposed management interfaces, and improper input handling. Fix these by enforcing strict authentication, disabling unused services, validating all inputs, and isolating privileged components from public networks.

Read the full guide: Unauthenticated RCE Mistakes: 7 Errors That Expose Your Systems

What to do and how to stay safe: Nextcloud

• Verify if your Nextcloud instance uses the Collabora Online Built-in CODE Server app and check its current version.
• Update the richdocumentscode app to version 26.4.303 or later as soon as possible to close the injection vector.
• Scan server file systems for unexpected scripts or web shells that may have been planted during the exploitation window.
• Review web server logs for unusual activity or requests to proxy.php during periods when the CODE server was not running.

Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits

General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this affect standalone Collabora Online servers?

No, the flaw only affects the Collabora Online Built-in CODE Server app within Nextcloud deployments.

Is this the same as CVE-2025-66208?

No, Collabora confirms this is a different attack path, and the previous fix does not block this exploit.

Do attackers need a user account to exploit this?

No, the vulnerability allows remote attackers to run commands without logging in or requiring user interaction.