Say your company runs Nextcloud as its shared file store so people stop emailing files around. Accounting keeps invoices there and HR keeps employment contracts. During setup, the IT team turned on the Built-in CODE Server app, because it lets staff open and edit Word or Excel files in the browser without running a separate document server.
That app is exactly where attackers have been getting in since September, and some companies that think they switched it off are still exposed.
What happened
On 23 October 2026, CISA, the US cybersecurity agency, added CVE-2026-110447 to its Known Exploited Vulnerabilities (KEV) list and gave US federal agencies until 26 October 2026 to fix it. That is three days.
According to Collabora's security advisory published on 14 October 2026, the flaw sits in the Collabora Online Built-in CODE Server app for Nextcloud (the app ID is richdocumentscode), in versions before 26.4.303. The main points:
- A crafted request to the app's proxy.php file runs an operating system command as the web server user.
- No login and no user action are needed.
- The condition is that the built-in document server is not running at that moment, for example after a restart, an upgrade or a crash. That happens more often than people expect.
- Severity is Critical, with a CVSS v4 score of 9.2.
- Standalone Collabora Online servers are not affected.
The timeline, from the sources we checked:
- 11 September 2026: an administrator opened a GitHub issue on the project reporting that several Nextcloud servers had been attacked through proxy.php. BleepingComputer reports that version 26.4.303 with the fix was released the same day.
- 3 October 2026: a post on the Nextcloud community forum urged Built-in CODE users to update immediately because attacks were ongoing.
- 14 October 2026: Collabora published the advisory and the CVE.
- 23 October 2026: CISA added it to KEV.
So the fix existed from mid-September, but the formal advisory came more than a month later. Anyone who waited for an advisory before updating left the door open for over four weeks.
What attackers did once inside
Reports in the project's issue tracker describe attackers using proxy.php to write PHP files onto the server, with names like shx*.php. These files work as a back door for running further commands. On one machine, the attacker searched for password database files (.kdbx) and crypto wallet files. Another user on the Nextcloud forum found a different unexpected PHP file in the app folder by running the file integrity check.
BleepingComputer reports that some users said ransomware operators used this flaw, but it could not confirm those claims. Nextcloud said it had not seen widespread exploitation.
Why disabling the app does not help
The mistake many companies will make is to click disable in the settings page and move on. Collabora's advisory says plainly that disabling the app is not a mitigation. The app must be upgraded to 26.4.303 or later, or removed. If you still run Nextcloud 29 or older, which is end of life, upgrade Nextcloud or remove the app.
The good news is that some setups are not affected. According to Collabora and the forum post, standalone Collabora Online servers, Docker and Linux package installs, Nextcloud All-in-One and hosted Collabora services are not affected. The problem is only the richdocumentscode app, not the richdocuments app that connects Nextcloud to an external document server.
