By 
Recent security reports have highlighted a significant vulnerability within the Nextcloud application, specifically affecting the Collabora Online – Built-in CODE Server. This flaw allows attackers to exploit the app to inject web shells onto Nextcloud servers, essentially enabling them to execute commands remotely. The issue, which came to light following reports from three administrators on GitHub, has raised alarms regarding the potential risks for users of this popular cloud storage solution.
The vulnerability is documented as CVE-2026-110447, and it poses a serious risk, particularly when the local document server is not operational, such as during server restarts or updates. Attackers can take advantage of unauthenticated requests to issue commands through the request path, which are then executed with the privileges of the web server account. This means that malicious actors can leverage this access to deploy web shells—small files that allow for remote command execution—all without the need for authentication.
The problematic app in question, known as richdocumentscode, is primarily designed for local testing environments and is not intended for production use. Its inclusion in production environments, however, has led to unwanted exposures. The earliest recorded incident of this exploit emerged on September 10, 2026, with a series of attacks being observed throughout September and October, during which attackers focused on locating credential stores and cryptocurrency wallets.
In response to the vulnerability, the developers at Collabora released a patch on September 11, addressing the issue with version 26.4.303. This update was crucial for maintaining the security of Nextcloud servers. Following the release of the patch, an advisory issued on October 14 clarified that merely disabling the affected app is insufficient to prevent exploitation; users must either update to the latest version or completely remove the application to ensure protection.
For organizations using older versions of Nextcloud that cannot accommodate the update, either upgrading the entire Nextcloud platform or uninstalling the problematic app has become imperative. Security experts emphasize that it is vital for administrators to not only update their systems but also to actively monitor for any residual malicious PHP files that may have been left behind following an attack. Checking access logs for any suspicious activity can help in identifying any potential breaches.
Although no reports have emerged indicating that attackers gained root access through this vulnerability, any data that is accessible by the web server account remains vulnerable to compromise. This includes potentially sensitive information that could be exploited if not adequately secured. Given the risks presented by web shells, users are encouraged to act promptly to protect their systems.
The Nextcloud community is robust, and the emphasis on security highlights the importance of maintaining best practices in managing server applications. Regular updates and vigilance are crucial for safeguarding against emerging threats. Users should remain proactive in evaluating their configurations and ensuring that they are using secure versions of the software. The recent vulnerabilities serve as a potent reminder of the dynamic nature of cybersecurity, where both software providers and users must work collaboratively to enhance security posture and mitigate risks.
Source: scworld.com
