An optional app, described as meant for testing, was all it took to take over Nextcloud servers.
What happened#
Nextcloud offers an app called “Collabora Online - Built-in CODE Server” (richdocumentscode), which downloads and runs an online office suite directly on the Nextcloud server. Its listing describes it as meant for local testing, personal use or small teams.
Up to version 26.4.302, one of the app’s scripts placed part of the requested URL inside a system command. The result: a single request, with no account, could run commands on the server (CVE-2026-110447). The attack only worked at a specific moment: when the built-in document server was down, for example after a restart, an upgrade or a crash.
The first attacks show up in logs on 10 September 2026. Attackers planted PHP web shells in the app’s folder. The fix, version 26.4.303, was released on 11 September.
Why it matters#
Two details make this case worth a closer look:
- Disabling the app wasn’t enough. Its files stayed on the server and remained reachable. The vendor is clear: update it or remove it.
- Exploitation started the day before the fix. A server updated afterwards is no longer vulnerable, but a web shell planted earlier is still there.
What to take away#
- Every installed extension is part of the attack surface, even an optional one, even one you rarely use. If you don’t need it, remove it.
- A “for testing” component has no place in production.
- Disabled is not removed. As long as the code is on disk, it can be called.
- Patching doesn’t clean up. After an exploited flaw, you also have to look for traces: here,
shx*.phpfiles in the app’s folder and suspicious requests in the logs since 10 September.
