Who this is for: administrators who run Nextcloud on their own server or VPS and have installed the app Collabora Online - Built-in CODE Server (app ID richdocumentscode, an app that runs an office document editing server inside Nextcloud). This page is based on the developers' security advisory and blog, and CISA's public data. It does not cover how the attacks work.
Developing: this page will be updated as more is published
As of 23:00 UTC, October 24, 2026Not yet known
- How many servers or organisations were affected
- Who is behind the attacks
- Official guidance on checking for compromise (not in the advisory)
- Whether the ARM64 app of the same name (richdocumentscode_arm64) is covered
The developers published the security advisory and CVE on October 14 and explained the scope in a blog post on October 15. CISA added the flaw to KEV on October 23. Neither the number of victims nor who is behind the attacks has been published. This page will be updated when the advisory is revised.
What to do today (if the built-in CODE app is installed)
Check whether the app is installed and which version
Log in as an administrator and look for Collabora Online - Built-in CODE Server on the Apps page. Check the list of disabled apps as well as enabled ones. From the command line, run php occ app:list in the Nextcloud directory as the web server user; it shows each app, whether it is enabled, and its version. If richdocumentscode does not appear, you are not affected by this flaw.
Before updating or removing, save the check output and a copy of the directory
Updating or removing the app replaces its directory, and planted files and other evidence would be lost. First run php occ integrity:check-app richdocumentscode and save the output, then copy the whole app directory (richdocumentscode under apps or custom_apps) somewhere else (this site's recommendation).
If it is older than 26.4.303, update it
Update from the Apps page or with php occ app:update richdocumentscode. The fix is in 26.4.303; as of October 25 the app store offers 26.4.502 for Nextcloud 30 and later. After updating, confirm the version is 26.4.303 or higher.
If you do not use it, or run Nextcloud 29 or older, remove it
The developers say disabling does not prevent the problem. If you do not use it, remove it with php occ app:remove richdocumentscode and confirm the app directory (richdocumentscode under apps or custom_apps) is gone. No fixed version is offered for Nextcloud 29 and older, so upgrade Nextcloud to 30 or later, or remove the app.
Check for signs of intrusion
If you ran a version older than the fix at any point since around September 10, check the copied app directory, web server logs and running processes as described in "How to check for compromise" below. Updating may not remove files that were already planted.
If you find traces, isolate first
If you find files or processes you do not recognise, do not just delete them and carry on. Take the server off the network, keep the logs and evidence, then move on to changing credentials and restoring. The steps are in "If the server was compromised" below.
Are you affected? Quick reference
| What you run | Affected? | What to do |
|---|---|---|
| richdocumentscode installed, before 26.4.303 (enabled or disabled) | Yes (advisory) | Update or remove |
| richdocumentscode 26.4.303 or later | Fixed (advisory) | Check for traces from before the update (our recommendation) |
| richdocumentscode on Nextcloud 29 or older | Yes. The newest version offered for 29 and older is 26.4.104, before the fix | Upgrade Nextcloud to 30 or later, or remove the app (advisory) |
| Connecting to a standalone Collabora Online server (Nextcloud Office, richdocuments, only) | Not affected (advisory) | Nothing for this CVE |
| Collabora Docker image, RPM/DEB packages, Nextcloud All-in-One | Not affected (developers' blog) | Nothing for this CVE |
| richdocumentscode_arm64 (the ARM64 app) | Not mentioned in the advisory | Same version line; we recommend updating to the latest (our view) |
Even on All-in-One, if you later added richdocumentscode from the Apps page, check that app as affected (our view). Whether you are affected depends on whether richdocumentscode is installed, not on the name of your setup.
1. Installed?
richdocumentscode present, including disabled
2. Version
Affected if before 26.4.303
3. Traces since Sep 10
Check if you ran an old version
What was disclosed (developers' advisory)
- CVE
- CVE-2026-110447 (GHSA-g3vx-3m76-fghh)
- Type
- OS command injection (CWE-78) in the app's proxy.php
- Severity
- CVSS v4.0 9.2 (critical). Network attack vector, no authentication, no user interaction. Attack requirements present (AT:P)
- Impact
- OS commands may run as the web server user
- Condition
- The built-in CODE server is not running (for example after a container restart, an upgrade or a crash)
- Affected
- richdocumentscode before 26.4.303
- Fix
- Update to 26.4.303 or later, or remove the app. Disabling is not enough. On Nextcloud 29 and earlier, update Nextcloud or remove the app
- Not affected
- Standalone Collabora Online servers (advisory). Docker images, RPM/DEB packages, Nextcloud All-in-One (developers' blog)
- Fix released
- 26.4.303 on September 11, 2026 (developers' release list)
The advisory says this flaw uses a different path from an earlier vulnerability (CVE-2025-66208), and the fix for that one does not prevent this one. Having handled the earlier flaw does not remove the need for this update.
CISA added CVE-2026-110447 to KEV on October 23 and set October 26 as the due date for US federal agencies. The KEV entry marks it as requiring forensic triage. Known ransomware campaign use is listed as "Unknown".
When the attacks started
The fix came out on September 11, but the advisory and CVE were not published until October 14. In the meantime, users reported in the developers' repository that from around September 10 they saw suspicious requests to proxy.php and PHP files they did not recognise in the app directory. On the Nextcloud community forum, a user urged others to update on October 3.
According to BleepingComputer (October 15), the planted web shells (malicious files that let an outsider send commands to the server) were used to look for password vault files and cryptocurrency wallets. Some users said ransomware was involved, but the outlet says it could not confirm this. According to the same report, the developers attributed the late announcement to a backlog in CVE processing.
This site's view: during the month between the fix and the advisory, administrators who did not update apps automatically had no signal that this update was urgent. A process of "patch when an advisory appears" leaves that whole window open. Nextcloud apps need their own update check, separate from Nextcloud itself.
A disabled, forgotten app still counts
The developers say disabling the app does not prevent the problem. If you once installed it to try and stopped using it, check it while its files remain. The lesson here is to remove unused apps, not just disable them (our view).
How to check for compromise (defender-side checks)
These are checks an administrator runs on their own server. Do not try to reproduce the attack.
Run Nextcloud's integrity check
Nextcloud can check whether an app's files match the published release. Run php occ integrity:check-app richdocumentscode and look for files that are not in the release (EXTRA_FILE) or files whose contents differ. Users have reported noticing the compromise when Nextcloud's integrity check failed. As in "What to do today" above, run it before updating or removing the app and save the output.
Look for unfamiliar files in the app and web directories
Besides the richdocumentscode directory, list PHP files created or changed since September 10 across the Nextcloud directory (for example find /path/to/nextcloud -name "*.php" -newermt 2026-09-10). Updates also change dates, so focus on names that are not part of the official release.
Check web server logs for requests to proxy.php
Extract requests to richdocumentscode's proxy.php from the access logs (for example grep "richdocumentscode/proxy.php" access.log*). Look for requests since around September 10 from sources you do not recognise, or requests with unusually long strings. Some requests use URL-encoded forms, so also search simply for lines containing "proxy.php" (for example grep "proxy.php" access.log*). If your logs are kept only briefly, check what remains and note the period covered.
Check processes and connections of the web server user
Check the processes running as the web server user (www-data, apache, nginx and so on) and outbound connections. Look for shells, download tools or anything else the web server does not normally start. Our guide on how to check whether your website or server was hacked covers the full process.
If the server was compromised
Because commands run as the web server user, assume anything that user can read has been seen (our view). For Nextcloud, that includes the database password and the external storage and mail credentials in config.php, as well as users' files.
Responses to avoid
- Deleting the files you found and carrying on
- Updating without checking whether anyone got in
- Rebuilding the server before keeping the logs
- Restoring without changing credentials
Recommended response
- First take the server off the network and keep copies of logs and evidence elsewhere
- Change the database, external storage, mail, administrator and app passwords
- Restore from a backup taken before September 10, or rebuild, and apply the fix before going back online
- Decide whether users need to be told their files may have been seen
A restored backup may bring back an old version of richdocumentscode. Update or remove the app before you expose the server again. If an organisation uses the server, check whether you have reporting duties for personal data. Our guide to backup essentials covers the basics of recovery.
For how to prioritise flaws listed in KEV, see deciding what to patch first with CVSS, EPSS and KEV.
What is not yet known
| Item | Status |
|---|---|
| Active exploitation | Confirmed (CISA KEV) |
| When attacks began | User reports from around September 10 in the developers' repository; no official statement |
| Number of affected servers or organisations | Not stated |
| Who is behind the attacks | Not stated |
| Ransomware use | "Unknown" in KEV; the press says it could not confirm |
| Official compromise checks or indicators | Not in the advisory |
| The ARM64 app (richdocumentscode_arm64) | Not mentioned in the advisory |
Sources
- Collabora Online developers, "Unauthenticated OS command injection in the richdocumentscode proxy" (GHSA-g3vx-3m76-fghh, October 14, 2026) — github.com
- Collabora Online developers' blog, "Stay Safe: Upgrade Everything Regularly" (October 15, 2026) — collaboraonline.com
- richdocumentscode release list (26.4.303: September 11) — github.com
- richdocumentscode issue #354 (user reports of attacks, from September 11) — github.com
- Nextcloud community forum, "To Collabora Built-in User: Update ASAP" (from October 3) — help.nextcloud.com
- CISA, Known Exploited Vulnerabilities Catalog (CVE-2026-110447) — cisa.gov
- BleepingComputer, "Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers" (October 15, 2026) — bleepingcomputer.com
Update history
2026-10-25: First version, based on the developers' advisory, blog and release list, CISA's KEV catalog and press reports.
Read next
- Checking for compromise: How to check if your website or server was hacked
- Prioritising fixes: Deciding what to patch first: CVSS, EPSS and KEV
- Recovery: Backup essentials
- Another exploited flaw from the same period: SiteGuard Server Edition CVE-2026-106931
- Glossary: What is RCE? / What is a backdoor? / What is CVSS?