Published October 14, the GitHub Advisory Database entry says CVE-2026-110447 is different from CVE-2025-66208 and describes exploitation in the wild during September and October 2026. It identifies Nextcloud’s built-in richdocumentscode app as affected and says the flaw can enable remote code execution when the local CODE server is not running.
Which Nextcloud setup is affected?
The advisory covers Nextcloud’s optional Collabora Online - Built-in CODE Server app, richdocumentscode. Standalone Collabora Online servers are not affected by this vulnerability. The distinction matters if you run Collabora separately rather than through Nextcloud’s built-in app.
NeoTeo previously covered an alert involving Nextcloud’s built-in CODE app.
What patching does—and does not—do
In an October 15 report, Pasquale Pillitteri described attackers using unauthenticated requests to plant PHP web shells in the app directory. The reported shells ran with the web server account’s permissions, usually www-data. Pillitteri described three public incident accounts and said the total number of affected servers was unknown. Pillitteri’s incident reporting
Pillitteri recommends updating richdocumentscode to 26.4.303 or later, or removing the app; disabling it alone does not close the vulnerability. The report also says an update does not remove a shell already planted, so patching and checking for persistence are separate tasks. For Nextcloud 29 or earlier, Pillitteri advises upgrading Nextcloud or removing the app.
The Hacker News posted a warning on October 14 about the reported web shells and advised updating or removing the built-in app. Its post is in English:
The reported response sequence
Pillitteri recommends searching the app directory for files matching shx*.php and shrf*.php, and reviewing access logs from September 10 onward for requests to proxy.php?status and the reported suspicious patterns. If a shell is found, the report advises rotating secrets readable by the web server account.
