Nextcloud Collabora CODE Backdoor (CVE-2026-110447): Disabling the App Won't Fix It
On October 14, 2026, Collabora published a security advisory for a critical flaw in its Collabora Online – Built-in CODE Server app for Nextcloud — the app most self-hosters use for in-browser document editing. Tracked as CVE-2026-110447, it lets an attacker run operating-system commands on your server without logging in, and it has been exploited in the wild since at least September 10, 2026 — attackers planted PHP webshells and hunted for password databases and crypto wallets (The Hacker News, Censys).
Here's the part that makes this a homelab emergency rather than just another CVE headline: Collabora's advisory says disabling the app is not enough. You must update it to version 26.4.303 or later, or remove it entirely — and if your server was exposed, patching alone doesn't clean up webshells an attacker may already have planted. Below is the end-to-end playbook: the 30-second "am I affected" check, the fix with copy-paste commands for bare metal, Docker and NextcloudPi, and the compromise-hunt workflow. Every fact is verified against the advisory and reputable reporting — anything I couldn't verify is labeled as such.
Am I Affected? The 30-Second Check
The vulnerable component is a single optional app, packaged as richdocumentscode — shown in Nextcloud's app list as "Collabora Online - Built-in CODE Server". It bundles a local Collabora Online Development Edition (CODE) instance for in-browser document editing. If you installed it — and most homelabbers did, because it was the path of least resistance — check your version:
# Run from your Nextcloud directory, as the web-server user (standard occ usage, docs-verified)
sudo -u www-data php occ app:list | grep -i richdocumentscodeIf the output shows a version below 26.4.303, you are affected.
You are NOT affected if any of these describe your setup (per Collabora's advisory, via the reporting):
- You use the Nextcloud Office app (
richdocuments) pointed at a separate Collabora server — Docker, distro package, or hosted. - You run Nextcloud All-in-One (AIO) — the advisory does not implicate AIO images.
- The built-in CODE app was never installed on your instance.
proxy.php code can remain reachable. This is the single most dangerous misunderstanding about this CVE. Why Disabling the App Is Not a Fix
This runs against every admin instinct: see a critical advisory, flip the app off, confirm it says "disabled," move on. Collabora's advisory explicitly warns that this stopgap does not remediate CVE-2026-110447 — the vulnerable proxy logic can remain reachable with the app disabled in the UI. The only two remediations the advisory names: update to 26.4.303 or later, or fully remove the app. If you can't update right now, removal is the safer interim step — not the toggle.
The Fix: Update to 26.4.303 or Remove the App
Bare Metal: Update With occ
On a standard bare-metal install, update the app from the command line:
cd /var/www/html/nextcloud # your Nextcloud directory
sudo -u www-data php occ app:update richdocumentscode
sudo -u www-data php occ app:list | grep -i richdocumentscodeThe second command is not optional — verify the installed version reads 26.4.303 or later. App-store propagation can lag; don't assume the update took. If you'd rather remove the app (or the update isn't offered), remove it completely:
sudo -u www-data php occ app:remove richdocumentscodeDocker: Run occ Inside the Container
For Docker Compose installs, occ runs inside the app container as the web-server user — the standard Nextcloud-Docker pattern (docs-verified). NextcloudPi and snap users: find your occ (NextcloudPi: /var/www/nextcloud/occ) and run the same commands as www-data; if your appliance pins app versions, prefer removal over waiting for a pinned update.
# Replace 'nextcloud' with your actual container name
docker exec -u www-data nextcloud php occ app:list | grep -i richdocumentscode
docker exec -u www-data nextcloud php occ app:update richdocumentscode
docker exec -u www-data nextcloud php occ app:remove richdocumentscode # removal pathThe update-then-verify discipline applies here too. This careful update habit is the same pattern we use everywhere — see our Immich machine learning V2 update guide for the general Docker update workflow.
Nextcloud AIO: Not Affected
Nextcloud All-in-One images are not implicated by the advisory — no action needed there.
richdocumentscode release requires Nextcloud 30 or later, and the app store still serves affected versions to Nextcloud 29 and older (both end of life). If occ app:update won't offer you 26.4.303, do not sit on the vulnerable version: remove the app or upgrade Nextcloud itself. A "successful" update that leaves you on 26.4.302 is not a fix. Were You Already Compromised? Hunt for Webshells
Patching closes the door. It does not remove webshells an attacker may already have planted (Censys explicitly warns of this). If your server was internet-reachable with a vulnerable version installed at any point since early September, run this compromise hunt — in this order.
Step 1: Search for the Known Webshells
Administrators reported webshells named shx*.php and shrf*.php dropped inside the app directory — search yours:
# Bare metal — adjust the path to your install
find /var/www/html/nextcloud/apps/richdocumentscode -name 'shx*.php' -o -name 'shrf*.php'
# Docker
docker exec nextcloud find /var/www/html/apps/richdocumentscode -name 'shx*.php' -o -name 'shrf*.php'Any hit is a confirmed compromise — skip to the incident steps below. No hits is not a clean bill of health: also check for any unfamiliar PHP file in the app directory, and run Nextcloud's integrity check:
sudo -u www-data php occ integrity:check-app richdocumentscodeStep 2: Grep Your Access Logs for the Attack Pattern
The known malicious requests hit /apps/richdocumentscode/proxy.php?status with path-traversal or command-substitution markers. Review logs back to at least September 10, 2026:
# Apache — use /var/log/nginx/access.log on nginx
grep -E 'proxy\.php\?status.*(%2e%2e|\$\(|\$\{IFS\})' /var/log/apache2/access.logAlso look for base64 -d piped to sh in request paths, and any sudo attempts by the web-server account (www-data) in your auth logs — attackers ran as the web-server user.
Step 3: Check for Rogue Admin Accounts and Wrap Up
List users and look for accounts you didn't create, especially ones added since September:
sudo -u www-data php occ user:listIf You Find Evidence of Compromise
Treat the host as untrusted: isolate it, delete the webshells, and treat anything the web-server account could read as potentially exposed — rotate Nextcloud secrets, database passwords, and any credentials stored on the box. Attackers were observed searching for password-manager databases and crypto wallets. The safest recovery is restoring from a known-good backup from before the exposure window, then patching. If Nextcloud sits behind a reverse proxy and things look odd after the fix, our Nginx 502 Bad Gateway in Docker fix guide covers proxy-layer failures that can masquerade as app problems.
Dealing with ransomware instead of a backdoor? Our SafePay 3-2-1 survival guide covers immutable snapshots, pull-based offsite copies, and the NAS lockdown that stops backup sabotage.
Harden After the Fix
Once you're on 26.4.303+ (or the app is gone) and the hunt is clean:
- Keep the app updated. This is the second critical flaw in the same Collabora–Nextcloud integration layer in about a year — this bridge deserves ongoing scrutiny.
- Don't expose what you don't need. Every internet-facing app is patch-management you personally own — the same lesson as our Pi-hole v6.5 safe-update guide: self-hosting means the update window closes only when you act.
occ docs. The commands are standard occ usage — but I didn't run them against a live instance for this post, so confirm each step's output on your own system. Frequently Asked Questions
Is my Nextcloud affected if I use standalone Collabora Online?
No. Only the optional built-in CODE server app (richdocumentscode) is affected. Standalone Collabora Online — Docker, RPM/DEB, or hosted — is not, nor is Nextcloud All-in-One.
Does disabling the Collabora built-in CODE app fix CVE-2026-110447?
No. Collabora's advisory says disabling is not sufficient — the vulnerable code can remain reachable. Update to 26.4.303 or later, or fully remove the app.
How do I check if my Nextcloud server was hacked through this flaw?
Search the app directory for shx*.php webshells, grep access logs back to September 10, 2026 for proxy.php?status requests with %2e%2e, $( or ${IFS}, run occ integrity:check-app, and check for rogue admin accounts.
What if I'm on Nextcloud 29 or older?
The fixed app requires Nextcloud 30+. The app store still serves vulnerable versions to Nextcloud 29 and older — upgrade Nextcloud or remove the app entirely.
Will updating the app remove webshells already on my server?
No. Patching closes the hole but doesn't delete planted webshells. Update first, then hunt for shx*.php/shrf*.php files and review your logs.
Should I use 26.4.303 or the newer 26.4.402?
The advisory names 26.4.303. Admins reported 26.4.402 failing on some setups and reverted — 26.4.303 is the safe target if the newer build misbehaves.
If your Nextcloud runs on a PHP build below 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, stop here — the php2shell emergency RCE hits PHP itself, below Nextcloud, and no app update fixes it. Our php2shell patch playbook for self-hosters covers the Docker and bare-metal fix.
Comments
Post a Comment