A critical flaw in Nextcloud's Collabora CODE app has been used to plant web shells on servers since September. CISA has added it to its Known Exploited Vulnerabilities catalogue.
A critical flaw in the Collabora Online – Built-in CODE Server app (package name richdocumentscode), used by Nextcloud file-sharing and private cloud servers, has been under active attack since September. Tracked as CVE-2026-110447, it was added to the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalogue on 23 October 2026. The Hacker News reports a CVSS score of 9.2.
The weakness sits in the mechanism the app uses to start its bundled document server. According to BleepingComputer's 15 October report, whenever that embedded CODE server is not running — after a reboot, an upgrade or a crash — a specially crafted request to proxy.php can execute operating system commands with the privileges of the web server account. No credentials and no user interaction are required.
What the attackers are looking for
Drawing on reports from system administrators, eSecurity Planet describes attackers dropping PHP web shells into the app directory and then searching the server for password databases, password manager files and cryptocurrency wallet data. Reported indicators include unexpected PHP files in the app directory, unusual requests to proxy.php, and failed sudo attempts by the web server account. BleepingComputer traces the activity back to 10 September 2026.
That timeline is the uncomfortable part. The fix shipped in version 26.4.303 on 11 September 2026, but the security advisory only followed on 14 October. Many organisations therefore ran an exploitable server for roughly four weeks without knowing a patch existed.
Why this matters for smaller businesses
Plenty of companies run Nextcloud on their own hardware precisely because they want their files to stay in-house and their costs predictable. Those deployments typically sit on a single server, with limited log monitoring and manual updates. The catch is that Nextcloud app updates are handled through the app store, separately from the operating system, so this particular component can fall behind even where server patching is disciplined.
The data protection angle sharpens things further. A file-sharing server is usually where contracts, HR records, customer lists and financial documents live. Unauthorised access to one can trigger a breach notification obligation under Turkey's Personal Data Protection Law No. 6698. And patching alone is not enough: as eSecurity Planet points out, the update does not remove access an attacker has already established.
What we recommend at Kamer Bilişim
- Check the app version today. Confirm that richdocumentscode is on 26.4.303 or later. If you do not need the app, remove it — the vendor warns that disabling it is not sufficient. Standalone Collabora servers, Docker and RPM/DEB installations, and Nextcloud All-in-One deployments are not affected.
- Hunt backwards before assuming you are clean. Review access logs back to at least 10 September, look for PHP files you do not recognise in the app directory, and check for failed sudo attempts by the web server account. If you find traces, incident response comes before patching.
- Keep the file server off the open internet. Put admin interfaces behind a firewall, restrict access by VPN or IP allow-list, and keep a copy of your backups separate from the server itself. A backup sitting on the same network is not a backup in a ransomware scenario.
If you are not sure whether your Nextcloud, file server or private cloud setup is affected, get in touch through our contact page for a version check and a log review. We work on-site across the Anatolian side of Istanbul and provide remote support elsewhere.
Source: BleepingComputer, The Hacker News, eSecurity Planet, CISA
Source: BleepingComputer