Nextcloud administrators reported intrusions through the Collabora Online - Built-in CODE Server app. Published on October 14 as CVE-2026-110447, the flaw allows command injection while the local CODE server is stopped. Collabora had fixed the issue in version 26.4.303 in September.
The affected Nextcloud app
The flaw affects richdocumentscode, the Nextcloud app that bundles the Collabora CODE server. Standalone Collabora Online deployments are not affected. Exploitation depends on the local CODE process being down, for example after a restart or crash.
A request could run a command
The proxy.php script incorporated part of a request into a shell command when the local server was not responding. Administrators reported unauthenticated requests followed by PHP web shells. The number of compromised servers has not been publicly established.
Update or remove the component
Check the richdocumentscode version and upgrade to 26.4.303 or later. Remove the app if it is not used. Disabling it alone is not enough. An update will not automatically remove a web shell that may already be present.
Look for signs of compromise
Review HTTP and system logs around restarts, inspect the app directory for unexpected PHP files, and check scheduled tasks and new accounts. Isolate a suspected server and follow your incident-response process before returning it to service.
How Soclyde fits
This incident concerns a self-hosted collaboration component; Soclyde does not patch Nextcloud or Collabora. It can help teams organize credentials and control sharing. See the guide to sharing team passwords.
What to remember
Nextcloud administrators should distinguish the bundled app from standalone Collabora Online, patch richdocumentscode, and inspect for evidence. Disabling the component alone is insufficient.
