A Nextcloud office add-on was patched in September. Its CVE arrived on 14 October.
By Lior AharonovFounder, 7IT Solutions ·
BleepingComputer reports attacks on CVE-2026-110447, a critical command injection in the Nextcloud app Collabora Online Built-in CODE Server (richdocumentscode) before 26.4.303, sent through its proxy.php endpoint. No authentication is required, but the built-in server must be stopped, for example after a restart or crash. The fix shipped on 11 September; the advisory and CVE came on 14 October.
Your file server holds the documents everyone shares. Attackers planted webshells there to search for password databases, password manager files and crypto wallets. And for weeks, a scanner looking for a CVE number had nothing to find.
If you run Nextcloud with richdocumentscode, upgrade it to 26.4.303 or remove it today, since the vendor warns that disabling it is not enough. Then look for PHP files in the web root that you did not put there.
The CVE is not the starting gun. Attackers read commit logs too, and here they started weeks before the paperwork.
Lior Aharonov · my takeSources
- BleepingComputer: Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers bleepingcomputer.com
Researched with AI tools; every fact is checked against the linked sources.