Nextcloud CVE-2026-110447: Check for Web Shells Now

Last updated: 24 October 2026. Sources are listed at the end.

Attackers have been planting web shells on Nextcloud servers since about 10 September 2026. They abuse CVE-2026-110447, a command injection flaw in the optional Collabora Online – Built-in CODE Server app. No login is needed. The fix shipped on 11 September, but the public advisory only came out on 14 October, so many admins missed it. This CVE-2026-110447 guide shows how to check your server, fix it and look for web shells.

The short answer

Affected: the Nextcloud app richdocumentscode (Built-in CODE Server) before 26.4.303.
Fix: update the app to 26.4.303 or later, or remove it. Disabling the app is not enough.
Not affected: a separate Collabora Online server, Collabora run in Docker or from DEB/RPM packages, and Nextcloud All-in-One.

What is CVE-2026-110447?

The Built-in CODE Server app lets Nextcloud open office documents without a separate Collabora server. It includes a file called proxy.php. Attackers can pass shell commands through it, and the server runs them as the web server user, such as www-data.

There is one condition: the built-in CODE server must be stopped. That happens after a restart, an upgrade or a crash, so on a real server it is common. The flaw has a CVSS v4 score of 9.2 (Critical).

What attackers are doing

Admins first reported attacks around 10 September. The attackers drop small PHP web shells into the app’s folder, usually named shx followed by digits (for example shrf4645.php). Then they search the server for password databases, password manager files and cryptocurrency wallets. Some users reported ransomware groups using the flaw, although nobody has confirmed that.

As a result, if your server ran a vulnerable version at any point since early September, check it for compromise even after you update.

Step 1: Check your version

Run occ as the web server user from your Nextcloud folder:

cd /var/www/nextcloud
sudo -u www-data php occ app:list | grep -A1 richdocumentscode

Alternatively, open Apps → Your apps in the web interface and find “Collabora Online – Built-in CODE Server”. If the app isn’t installed, this flaw doesn’t affect you.

Step 2: Update or remove the app

# Update to the fixed version
sudo -u www-data php occ app:update richdocumentscode

# Or remove it completely if you don't use it
sudo -u www-data php occ app:remove richdocumentscode
ls /var/www/nextcloud/apps/richdocumentscode 2>/dev/null || echo "removed"

From version 26.4.302 onward, the app needs Nextcloud 30 or newer. So, on Nextcloud 29 or older, upgrade Nextcloud first or remove the app.

Step 3: Look for web shells

Even after the update, old web shells stay on disk. Check the app folder and run Nextcloud’s integrity check:

# Known web shell names
sudo find /var/www/nextcloud/apps/richdocumentscode -name 'shx*.php' -o -name 'shr*.php'

# Unexpected files reported as EXTRA_FILE
sudo -u www-data php occ integrity:check-app richdocumentscode

# PHP files changed since 1 September anywhere under apps/
sudo find /var/www/nextcloud/apps -name '*.php' -newermt '2026-09-01' -ls

Note that occ integrity:check-core only covers Nextcloud core, not this app.

Search your web server logs

Exploit requests hit proxy.php with path traversal or shell syntax. We tested this search on sample log lines:

sudo grep -iE 'richdocumentscode/proxy\.php.*(%2e%2e|%24%28|\$\(|IFS)' /var/log/nginx/access.log* /var/log/apache2/access.log* 2>/dev/null

Use zgrep for rotated .gz logs. Any hit from an unknown IP means you should treat the server as compromised.

If you find signs of compromise

Take the server offline or block public access, and keep a copy of the logs.
Delete the web shells, then update or remove the app.
Rotate every secret the web server could read: the database password, the secrets in config.php, object storage keys, SMTP passwords, app passwords and API tokens.
Check for new users, cron jobs and outbound connections.
Consider restoring from a backup taken before the first attack, then apply the fix before going back online.

If your Nextcloud stores customer or employee personal data, a compromise may also trigger reporting duties. In India, CERT-In expects incident reports within six hours. In addition, once the breach rules under the DPDP Act take effect, you will also have to inform the Data Protection Board and the people affected. Get advice on what applies to you.

Quick checklist

☐ Checked whether richdocumentscode is installed
☐ Updated to 26.4.303 or later, or removed it
☐ Searched for shx*.php files and ran the integrity check
☐ Searched access logs for proxy.php exploit requests
☐ Rotated secrets if anything was found

Self-hosted file servers are high-value targets. Our VAPT services and Linux server hardening and audit cover Nextcloud and the server underneath it. For other attacks this month, see our Black October fact-check.

Sources

Running Linux servers in production? Our Linux server hardening & security audit checks configuration, patching, SSH and logging. You can also use our free Linux server hardening checklist, or contact us.