Nextcloud and Collabora: A Vulnerability Already Being Exploited by Hackers

If you run Nextcloud with the built-in Collabora office suite, check your server today. A vulnerability, CVE-2026-110447, has been found in this office suite. It allows attackers to execute commands on the server without a username or password.

This is not theoretical. Hackers have been exploiting it since September 10, 2026, leaving behind malicious programs that give them a way back in. On October 23, the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its list of actively exploited vulnerabilities.

The fix is straightforward: update one app or remove it. Below are step-by-step instructions and checks to see whether your server has already been compromised.

What Are Nextcloud and Collabora?

Nextcloud is like having your own Google Drive. It stores files, calendars, and contacts, but on your own server rather than Google's. Companies and families that want to keep control of their data often install it on a VPS.

Collabora is an office suite inside Nextcloud. It works much like Google Docs: you open a document or spreadsheet in your browser and edit it there.

You can connect Collabora in two ways:

1. As a separate server. The office suite runs independently, for example in Docker, and Nextcloud connects to it.
2. As the built-in app, “Collabora Online - Built-in CODE Server.” You install it with one click from the Nextcloud app store. This is the simplest option, which makes it very popular.

Only the second setup is affected by this vulnerability. The app's technical name is richdocumentscode. Remember it: you'll need it for the checks below.

What Happened?

The built-in office suite contains a utility file called proxy.php. Think of it as a receptionist at the entrance. When the office suite is “asleep,” for example after a server reboot or an update, the receptionist wakes it up by sending a command to the server.

The problem was that the receptionist inserted part of a visitor's request into that command without checking it. Imagine a receptionist reading any note from a visitor aloud to security. The note says, “Open the safe and give everything to this person.” Security hears an instruction from a trusted employee and follows it.

The same thing happens here. An attacker sends a specially crafted request, and the server executes the attacker's commands. No username or password is required.

What hackers do after gaining access:

• Leave a backdoor on the server — a file that lets them return whenever they want.
• Read Nextcloud's configuration. It contains the database password and other secrets.
• Gain access to users' files.

Timeline

Note: the fix was released quietly, while the official warning appeared only a month later. Many administrators simply did not know they needed to update.

Who Is Affected?

Don't confuse the two apps. richdocuments (Nextcloud Office) and richdocumentscode (Built-in CODE Server) have very similar names. Only the second one is vulnerable.

An important detail: the attack works only when the built-in office suite is not running — for example, immediately after a server reboot, update, or crash. That is no reason to relax: servers reboot regularly, and bots scan them constantly.

Check Whether the Built-in Office Suite Is Installed

Through the web interface. Sign in to Nextcloud as an administrator. Open Apps, then Your apps. Find Collabora Online - Built-in CODE Server and check its version number.

Via SSH. Go to your Nextcloud directory (usually /var/www/nextcloud) and run:

sudo -u www-data php occ app:list | grep -i richdocumentscode

If Nextcloud was installed via snap, use:

sudo nextcloud.occ app:list | grep -i richdocumentscode

How to interpret the result:

• No output: the app is not installed, so this vulnerability does not affect you.
• Version 26.4.302 or earlier: go to step 2 immediately.
• Version 26.4.303 or later: the fix is installed, but you should still complete step 3.

Update or Remove the App

If you plan to remove the app, first perform checks 1 and 2 in step 3. Once it is removed, there will be nothing left in that location to inspect.

Option A: Update (if you need the office suite):

sudo -u www-data php occ app:update richdocumentscode

Then check the version again as described in step 1. You need version 26.4.303 or later.

Option B: Remove (if the office suite is rarely used):

sudo -u www-data php occ app:remove richdocumentscode

Remove it, don't just disable it. A disabled app remains on disk, and the vulnerability remains. It's like locking a room but leaving the window open.

If you run Nextcloud 29 or earlier: fixed versions work only with Nextcloud 30 and later. The latest version available for older Nextcloud installations is 26.4.104, which is vulnerable. You therefore have two options: upgrade Nextcloud itself to version 30+ or remove the app.

For the future: if you regularly need the office suite, running Collabora on a separate server, for example in Docker, is a more reliable setup. That deployment is not affected by this particular vulnerability and can be updated independently of Nextcloud.

Check Whether Your Server Was Compromised Earlier

Updating closes the door. But if a thief got in earlier, they may have left themselves a spare key. Attacks have been happening since September 10, so everyone who had an older version installed should check.

It's best to perform the first two checks before removing the app.

1. Integrity check. Nextcloud compares the app's files with the originals and flags unexpected files:

sudo -u www-data php occ integrity:check-app richdocumentscode

2. Look for unfamiliar files. In known attacks, hackers left files with names such as shx...php, shrf.php, or Nx_...php:

ls /var/www/nextcloud/apps/richdocumentscode/ | grep -Ei 'shx|shrf|nx_'

3. Check web server logs. Look for suspicious requests to proxy.php:

zgrep -h 'richdocumentscode/proxy.php' /var/log/nginx/access.log* /var/log/apache2/access.log* 2>/dev/null | grep -E '%2e%2e|\$\('

If any of these checks finds something, treat the server as compromised. Here's what to do:

1. Save copies of the files and logs you found. You'll need them for an investigation.
2. Change the database password and the secrets stored in config/config.php.
3. Ask users to change their passwords.
4. Ideally, migrate Nextcloud to a clean server. Removing one suspicious file is not enough: the attacker may have left others.

Checklist

• Checked whether richdocumentscode is installed.
• Identified its version.
• Ran an integrity check and looked for unfamiliar files.
• Checked logs for requests to proxy.php.
• Updated the app to 26.4.303+ or removed it.
• If running Nextcloud 29 or earlier, planned a Nextcloud upgrade.
• If signs of a breach were found, changed passwords and secrets.
• Considered moving Collabora to a separate server.

Don't Want to Handle It Yourself?

Updating the app is simple. Finding out whether your server was compromised is harder. Hackers hide their files, and logs contain thousands of lines. If there has been a breach, you need to move Nextcloud to a clean server without losing any user files.

Zomro offers two options for such cases.

SOD: We'll Check and Fix It for You

Our system administrator will:

• Check the version of the built-in office suite and update or remove it.
• Search for signs of compromise in files and logs.
• Change passwords and secrets if necessary.
• Help move Collabora to a separate server if you need the office suite on an ongoing basis.

Price: €12.50 per 15 minutes of work.

Request a Nextcloud Security Check

Premium: Fast Help When You Need It

Nextcloud stores documents, contracts, and photos. If something goes wrong, you can't afford to wait. A response to a standard support request may take up to 10 hours. With Premium, we respond within 5 to 30 minutes.

New vulnerabilities appear every week. With Premium, you don't have to deal with them alone.

Get Premium