If you self-host Nextcloud and installed the optional Collabora Online – Built-in CODE Server app, stop reading and check your server right now. Attackers have been breaking into Nextcloud instances through that app since mid-September, planting PHP web shells and hunting for password vaults and cryptocurrency wallets. CISA added the flaw, tracked as CVE-2026-110447, to its Known Exploited Vulnerabilities catalog on October 23, confirming active exploitation in the wild. The first logged attack hit on September 10 – a full month before the formal advisory went public.

Here is the part that stings: this is not the main Nextcloud product. It is an optional convenience app that bundles a copy of Collabora Online Development Edition (CODE) so admins can edit documents without running a separate office server. Its own store listing says it is “for local testing and non-production use.” A lot of small teams installed it to get document editing working quickly – and that quick fix is what got them owned.

What the vulnerability is. CVE-2026-110447 is an operating system command injection flaw in the app’s proxy.php script, rated critical (CVSS 9.2). In affected versions (everything before 26.4.303), the script builds a bash command to start the bundled CODE server whenever a request arrives and no server is running. Text from the request – including its path – was placed inside a double-quoted bash string, and in bash, $(...) inside quotes still executes. An attacker who sends a request with a command hidden in the path gets that command executed as the web server user. No authentication required, no user interaction, no login.

The catch that limits the window. The command only runs when the built-in server is stopped – such as right after a restart, an upgrade, or a crash. That sounds like a small window, but upgrades and restarts are routine, and unauthenticated scanning makes the timing a coin flip. Worse, the fixed version 26.4.303 shipped on September 11 with release notes that never mentioned a security fix, and the patch that shipped afterward (26.4.402) broke document loading for some setups, pushing admins back to the vulnerable build. Disabling the app does not help – the vulnerable script still runs directly from the app folder. You must update it or remove it.

What the attackers did. Public reports from three Nextcloud administrators show the playbook. The attackers sent malicious requests to proxy.php?status with shell commands embedded in the path, which decoded a one-line PHP web shell into the app’s directory. Then they used the shell to hunt for credential stores and cryptocurrency wallets – files like *.kdbx, wallet.dat, and keystore.json, and directory names like bitwarden, 1password, .bitcoin, .electrum, .monero, and .ethereum. One admin only found out when Nextcloud’s integrity check flagged the unexpected PHP file; another caught it from failed sudo attempts on the server. So far no observed root compromise, but anything the web server account can read – often including Nextcloud config, user files, and app data – has to be treated as potentially exposed.

Are you affected? Only if you run the “Collabora Online – Built-in CODE Server” app (package name richdocumentscode) on Nextcloud. Standalone Collabora Online servers, Docker/RPM/DEB installs, and Nextcloud All-in-One are not affected. But if you are on Nextcloud 29 or older, note that those versions are end-of-life, cannot install the fixed app, and the app store still serves them the vulnerable version.

What to do right now.

1. Update or remove the app. Upgrade richdocumentscode to 26.4.303 or later, or delete the app entirely. Disabling it is not enough – the vulnerable proxy.php runs outside Nextcloud’s app-disabled state.

2. If you are on Nextcloud 29 or older, upgrade Nextcloud or remove the app. There is no fixed version for you.

3. Hunt for web shells. Look for shx*.php files, starting in apps/richdocumentscode, and delete anything you did not create. Run Nextcloud’s built-in integrity check – it flagged this attack for at least one admin.

4. Check your logs. Review access logs back to at least September 10 for proxy.php?status requests whose paths contain %2e%2e, $(, or ${IFS}. Also look for sudo attempts from the web server account – a sign the shell was used to try to escalate.

5. Assume credential exposure. If you find any sign of a shell, rotate everything the web server account could reach: Nextcloud admin passwords, app passwords, mail credentials, API keys, and anything stored in user files. Export your crypto wallets and rotate those keys too – the attackers were explicitly looking for them.

Bottom line: this one is actively exploited, publicly documented, and aimed squarely at self-hosted setups that enabled an “easy” office app. Check your Nextcloud install now, update or remove richdocumentscode, and scan for shx*.php web shells before the attackers’ favorite file names show up in your own directory listing.