A critical security vulnerability affecting a specific Nextcloud document-editing setup has raised concerns after reports that attackers exploited it to install web shells on vulnerable servers. The flaw, tracked as CVE-2026-110447, affects the optional built-in Collabora Online CODE Server app used with Nextcloud.

The vulnerability could allow remote code execution under certain conditions, potentially giving attackers a way to run commands on an affected server. Although a fix is available, administrators need to confirm that they are running the affected component and have updated it to a secure version.

What Is the Nextcloud Security Vulnerability?

Nextcloud is a platform that allows individuals and organizations to store files, share documents, and collaborate using their own infrastructure or hosted services. Many users also connect it to online office tools to edit documents and spreadsheets through a browser.

One available option is the built-in Collabora Online CODE Server app. It provides document-editing functionality without requiring a separate Collabora server installation.

The security issue affects this particular built-in app, identified as richdocumentscode. It does not mean that all Nextcloud installations are vulnerable, and the issue is not present in standalone Collabora Online servers.

Tracked as CVE-2026-110447, the flaw is an operating system command injection vulnerability. It occurs in the app’s proxy.php component when the built-in CODE server is not running, such as during a restart or a temporary service interruption.

Under the relevant conditions, an attacker may be able to send a specially crafted request that causes commands to be executed on the affected server.

How Are Attackers Exploiting the Flaw?

Security reports indicate that attackers exploited the vulnerability during September and October 2026. The reported activity included placing web shells on compromised Nextcloud servers.

A web shell is a malicious script that provides a way to interact with a compromised server through web requests. Depending on its capabilities and the attacker’s permissions, it can be used to run commands, explore files, or maintain access after an initial compromise.

Reports linked to this campaign described attackers conducting reconnaissance and searching for sensitive information, including credential stores, password manager-related files, and cryptocurrency wallet data.

These activities demonstrate why a vulnerability in a document collaboration component can become a wider security problem. A server used to store and manage documents may also contain information that attackers could try to exploit.

However, the reported activity does not mean every vulnerable Nextcloud server has been compromised. The actual impact depends on the system’s configuration, exposure, and whether exploitation succeeded.

Which Systems Are Affected?

The affected component is Nextcloud’s built-in Collabora Online CODE Server app in versions earlier than 26.4.303.

The condition that makes this issue unusual is that the built-in CODE server must not be running when the relevant request is processed. This can occur during a restart, an upgrade, or after a crash.

That condition narrows the circumstances in which the flaw can be exploited, but it does not remove the need to update affected installations.

How to Fix the Nextcloud Vulnerability

Administrators who use Nextcloud’s built-in CODE Server should take the following steps.

1. Check whether the affected app is installed

Review the Nextcloud apps installed on your server and determine whether the built-in Collabora CODE Server component is in use. Do not assume that a Nextcloud installation is affected simply because it supports document editing.

2. Update to version 26.4.303 or later

Upgrade the built-in CODE Server app to version 26.4.303 or a later fixed release. Follow the official update instructions for your deployment and confirm that the update completed successfully.

If your organization manages multiple Nextcloud servers, check each relevant installation rather than assuming that one successful update covers the entire environment.

3. Review logs for suspicious requests

Look for unusual requests to the affected component, unexpected server processes, unfamiliar files, and other activity that may indicate unauthorized command execution.

Administrators should also investigate unusual access to document storage, password-related files, and other sensitive data.

4. Investigate possible compromise

Patching closes the vulnerability addressed by the update, but it does not automatically remove a web shell or undo an earlier intrusion. If suspicious activity is discovered, preserve logs and relevant evidence before carrying out a structured investigation.

Where compromise is suspected, review exposed credentials, assess the extent of unauthorized access, and follow an appropriate incident response process.

5. Reassess the document-editing setup

Organizations should consider whether the built-in CODE Server app is the right deployment option for their needs. Collabora has stated that the built-in app is primarily aimed at home users and is not its recommended installation method for general deployments.

That does not mean every user needs to replace the app immediately. The immediate priority is to apply the fix and confirm that the system has not been compromised.

Why This Matters Beyond Nextcloud

The incident highlights a wider cybersecurity lesson: a vulnerability does not have to affect a major operating system or a widely used browser to create serious risks.

Document collaboration platforms can store contracts, internal reports, business plans, customer records, and other sensitive files. If attackers gain command execution on a server hosting these services, they may try to use that access to investigate the wider environment.

The case also demonstrates the importance of checking the exact product component and deployment method. Two organizations can use the same general platform but face different risks because one uses an affected add-on while the other uses a separate service.

For administrators, keeping track of optional apps and their update status is just as important as maintaining the main platform.

Final Thoughts

CVE-2026-110447 is a critical command injection vulnerability affecting Nextcloud’s optional built-in Collabora CODE Server app. Reports of exploitation and web shell deployment make it important for administrators to check affected systems, install version 26.4.303 or later, and investigate any signs of unauthorized activity.

The most important takeaway is that updating the affected app and checking for evidence of compromise are separate tasks. A security patch can prevent further exploitation of the known flaw, but organizations still need to establish whether attackers gained access before the fix was applied.