[{"data":1,"prerenderedAt":211},["ShallowReactive",2],{"seo-verification":3,"blog-cve-2026-110447-nextcloud-collabora-update-or-remove-the-app-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-cve-2026-110447-nextcloud-collabora-update-or-remove-the-app-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":33,"intro":36,"sections":37,"ctaTitle":151,"ctaBody":152,"ctaButton":153,"ctaUrl":154,"relatedPosts":155},509,"cve-2026-110447-nextcloud-collabora-update-or-remove-the-app",{"fr":12,"en":10,"ar":13,"es":14},"nextcloud-collabora-cve-2026-110447-mettre-a-jour","ثغرة-cve-2026-110447-في-nextcloud-وcollabora-حدث-أو-احذف","cve-2026-110447-nextcloud-collabora-actualizar-o-retirar","CVE-2026-110447 Nextcloud Collabora: update or remove the app","CVE-2026-110447: the richdocumentscode app lets attackers run commands without authentication. Affected versions, inventory, fix, and how to hunt for traces.",10,0,false,"2026-10-27T00:00:00+00:00","2026-10-27T23:58:39+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fnextcloud-collabora-cve-2026-110447-mettre-a-jour-poster.svg",{"categorySlug":34,"appSlug":35},"collaboration-productivity","nextcloud","A critical flaw is being exploited in Nextcloud's built-in Collabora server, and the attacks began about a month before the advisory was published. If your instance, or your clients' instances, ships the `richdocumentscode` app, updating it is not enough: a server patched today may have been compromised before. This guide gives the commands to find out whether you are affected, fix it by update or removal, check the result, then hunt for traces of an intrusion that may already have happened.",[38,42,52,84,87,106,108,126,129,138,142,145,148],{"type":39,"title":40,"body":41},"h2","What richdocumentscode 26.4.303 fixes","CVE-2026-110447 is an unauthenticated operating-system command injection, classed CWE-78 and scored 9.2 on CVSS 4.0 in Collabora's advisory. It affects a single application: Collabora Online - Built-in CODE Server, identifier `richdocumentscode`, an **optional** Nextcloud module that embeds a Collabora server inside the app itself. The entry point is the application's `proxy.php` file. The advisory states that a request can make the system run a command with the web server user's rights.\n\nThe fix is version 26.4.303: the commit dates from September 9, 2026 and the version has been available since September 11, 2026. The advisory itself was only published on October 14, 2026, more than a month later. Collabora puts the delay down to CVE-processing backlogs on GitHub. The practical consequence: a server that stayed behind may have been attacked well before the identifier existed. This article starts from that fact and therefore deals with two questions, not one: the fix, and the search for traces.",{"type":43,"title":44,"items":45},"ul","What is known about the exploitation",[46,47,48,49,50,51],"**Attack condition** — the advisory specifies that the attack only works while the built-in CODE server is not running: container restart, upgrade, crash. No authentication or interaction is required.","**Start of the attacks** — administrators report first attacks on September 10 and 11, 2026 against version 26.4.302. BleepingComputer says mid-September; sources differ by a few days, and we do not settle it.","**Listed in KEV** — CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on October 23, 2026, with a federal deadline of October 26. Exploitation is observed, not theoretical.","**What the attackers looked for** — PHP webshells dropped on the server, then searches for password databases, password managers and cryptocurrency wallets.","**Ransomware: unconfirmed** — users mentioned it on the project's issue; BleepingComputer could not confirm it. We report it as a rumour, nothing more.","**Number of servers affected** — unknown. No primary source gives a figure.",{"type":53,"title":54,"headers":55,"rows":59},"comparison","Affected versions, fixed versions, unaffected setups",[56,57,58],"Setup","Status","Action",[60,64,68,72,76,78,80],[61,62,63],"`richdocumentscode` app older than 26.4.303","Vulnerable","Update to 26.4.303 or later, or remove the app",[65,66,67],"`richdocumentscode` app at 26.4.303 or later","Fixed","Still look for traces dating from before the update",[69,70,71],"`richdocumentscode` app merely disabled","Not protected","Disabling is not enough: update or remove",[73,74,75],"Standalone Collabora Online server","Not affected, per Collabora","No action tied to this CVE",[77,74,75],"Collabora in Docker or as an RPM\u002FDEB package",[79,74,75],"Nextcloud All-in-One",[81,82,83],"Nextcloud 29 or earlier","End of life","Update Nextcloud, or remove the app",{"type":39,"title":85,"body":86},"Built-in CODE or external server: how to tell","Many administrators do not know which of the two they run, because the Nextcloud Office app shows the same editor in both cases. The difference is found elsewhere. The \"external\" Collabora server is a separate service (container, package, dedicated machine) that Nextcloud connects to through a URL entered in the Nextcloud Office settings. The \"built-in\" server is one more Nextcloud app, `richdocumentscode`, which downloads and starts a local server.\n\nThe reliable criterion is therefore the presence of the app, not the address shown in the settings. If `richdocumentscode` is installed, you are within the advisory's scope, whether it is enabled or not. If it is absent, this CVE does not concern you, even if you use Collabora. A Nextcloud forum participant also notes that installations using `richdocuments` without `richdocumentscode` are not affected.",{"type":88,"title":89,"steps":90},"steps","Inventory one server, then a whole fleet, in five steps",[91,94,97,100,103],{"title":92,"body":93},"List the installed apps","From the Nextcloud directory, or inside the container, run `sudo -E -u www-data php occ app:list | grep richdocumentscode`. Adapt the user and path to your installation. A line in the output means the app is present, enabled (`Enabled`) or not (`Disabled`).",{"title":95,"body":96},"Read the installed version","Run `sudo -E -u www-data php occ config:app:get richdocumentscode installed_version`. If the number is below 26.4.303, the installation falls within the advisory's range.",{"title":98,"body":99},"Check what Nextcloud Office uses","Open the Nextcloud Office settings and note the Collabora server URL. It does not replace step 1: the presence of the app takes precedence over the displayed address.",{"title":101,"body":102},"Compare with the updates available","`sudo -E -u www-data php occ app:update --showonly` lists the app updates on offer without applying them. Check whether `richdocumentscode` appears.",{"title":104,"body":105},"Repeat on every server and record the result","On a fleet, run the same three commands over SSH on each client instance and paste the output into a table: client, server, app present, version, check date. That table is what lets you answer a client who asks whether they are affected.",{"type":39,"title":71,"body":107},"The reflex is to disable the app in the meantime. Collabora's advisory is unambiguous: it is not sufficient to disable the app, which must be upgraded to 26.4.303 or later, or removed. The vulnerable file stays on disk as long as the app is not removed, and the advisory does not say that a disabled file becomes unreachable.\n\nChoose according to use. If your users edit documents with the built-in server, update. If you do not use it, or if you have an external Collabora server, remove the app: it is the only option that removes the attack surface. If your Nextcloud is version 29 or earlier, it is no longer maintained: the advisory asks you to upgrade Nextcloud itself, or remove the app.",{"type":88,"title":109,"steps":110},"Fixing it: update or removal",[111,114,117,120,123],{"title":112,"body":113},"Back up before acting","Take a snapshot of the machine or a backup of the database and data directory. If you already suspect a compromise, also keep a copy of the logs before changing anything: they will serve the trace hunt below.",{"title":115,"body":116},"Update the app","`sudo -E -u www-data php occ app:update richdocumentscode`. Then run `occ config:app:get richdocumentscode installed_version` again to confirm the number is 26.4.303 or higher.",{"title":118,"body":119},"Or remove the app","`sudo -E -u www-data php occ app:remove richdocumentscode`. The command disables then removes the app; the `--keep-data` option keeps its data. Confirm with `occ app:list`, which should no longer mention it.",{"title":121,"body":122},"Restart the relevant service","Restart PHP-FPM or the Nextcloud container so that no process keeps the old code in memory. Remember that the exploitation condition is precisely a restart or crash of the built-in server.",{"title":124,"body":125},"Check the result","Replay the inventory from the previous section: the app must be absent or at 26.4.303 minimum. Note the date and time of the fix; they will serve as a boundary in the trace hunt.",{"type":39,"title":127,"body":128},"A server patched today may have been compromised before","The update closes the door; it says nothing about what has already come in. The first reported attacks date from September 10, 2026, and an administrator reported on the Nextcloud forum that a malicious file had remained after the update. An up-to-date server is therefore not a healthy server.\n\nThe official advisory lists no indicator of compromise. What follows is not an official indicator list: it is a generic hunting method, together with what administrators reported on the project's richdocumentscode#354 issue. One piece of common sense applies to all of it: none of these checks proves the absence of a compromise; they can only reveal one.",{"type":43,"title":130,"items":131},"Trace-hunting method (generic, to adapt)",[132,133,134,135,136,137],"**Recent PHP files** — `find \u002Fvar\u002Fwww\u002Fnextcloud\u002Fapps\u002Frichdocumentscode -name '*.php' -newermt 2026-09-01` lists PHP files modified since September 1 in the app directory. Do the same on the data directory, where no PHP file has any reason to exist.","**Reported names** — administrators found `shx*.php` files in the Nextcloud directory (issue #354); another found a file with a different name in `apps\u002Frichdocumentscode\u002F`. Searching for `shx*.php` is useful, but the absence of that name proves nothing: attackers can choose another.","**Comparison with the official archive** — download the app version from the official catalogue, unpack it in a temporary directory and compare with `diff -r`. Any extra or different file is suspect.","**Nextcloud integrity check** — one administrator discovered their malicious file because the integrity check flagged it. Run it and read the result.","**Web server logs** — `zgrep -hE 'proxy\\.php.*(%2e%2e|IFS)' \u002Fvar\u002Flog\u002Fnginx\u002Faccess.log*` looks for requests to `proxy.php` carrying a `%2e%2e` sequence or the shell variable IFS. The requests reported on the issue targeted `\u002Fapps\u002Frichdocumentscode\u002Fproxy.php?status`; a forum administrator advises going back to September 10. Adapt the path to Apache or to your log rotation.","**Odd processes** — administrators observed `coolwsd` and `coolforkit-ns` processes under the web server user with a payload in the `remote_font_config.url` argument. These processes also exist legitimately when the built-in server runs; it is the content of the argument that is abnormal.",{"type":139,"title":140,"body":141},"tip","If you find something: the machine is compromised","A webshell runs commands with the web server user's rights. Treat everything that user can read as exposed: Nextcloud's `config.php` (database credentials, secrets), app passwords, SSH keys and tokens it can read, mounted external storage. Rotate those secrets, then restore from a backup dating from before September 10, 2026 rather than \"cleaning\" the machine in place. For a client, tell them: it is their content that was exposed.",{"type":39,"title":143,"body":144},"A fleet of client Nextclouds: who carries what","For an agency, this CVE is not a command, it is an inventory. Each client has their own instance, their own version, sometimes an app installed \"to try\" two years ago. A client's question is predictable: \"are we affected, and have you checked?\". The honest answer is in the table from step 5 of the inventory, with the check dates.\n\nResponsibility splits simply: you manage the client relationship and decide the action (update, removal, restore); we keep the infrastructure these servers run on. With ServOrbit.com's \u003Ca href=\"\u002Fsolutions\u002Fagences\">solutions for agencies\u003C\u002Fa>, a single space brings together each client's servers, renewals and security, which avoids rebuilding the fleet from spreadsheets on the day of an alert. If you are a professional running a single instance, the \u003Ca href=\"\u002Fsolutions\u002Fprofessionnels\">solutions for professionals\u003C\u002Fa> page describes the support that suits you.",{"type":39,"title":146,"body":147},"The lasting safeguard: a Collabora kept separate from Nextcloud","According to Collabora, standalone Collabora Online servers, Docker and RPM\u002FDEB installations and Nextcloud All-in-One are not affected. The common point is that the editing server lives in its own container or service, outside Nextcloud's PHP tree. That is the \"sidecar\" architecture described in our guide \u003Ca href=\"\u002Fblog\u002Fnextcloud-collabora-onlyoffice-office-2021-eol\">Nextcloud, Collabora and OnlyOffice\u003C\u002Fa>: we do not redo the tutorial here. To start from scratch, \u003Ca href=\"\u002Fblog\u002Fheberger-nextcloud\">hosting Nextcloud\u003C\u002Fa> covers the deployment.\n\nThis is not an argument against the built-in app as such, only a way to reduce what has to be watched. We have also published two other emergency update guides, \u003Ca href=\"\u002Fblog\u002Fphp2shell-cve-2026-109618-109619-mettre-a-jour-php\">PHP2Shell\u003C\u002Fa> and \u003Ca href=\"\u002Fblog\u002Fnginx-cve-2026-15176-mettre-a-jour\">nginx CVE-2026-15176\u003C\u002Fa>: the method is the same, inventory, fix, verify, then look for what may have got through earlier.",{"type":39,"title":149,"body":150},"Official documentation","\u003Ca href=\"https:\u002F\u002Fgithub.com\u002FCollaboraOnline\u002Fonline\u002Fsecurity\u002Fadvisories\u002FGHSA-g3vx-3m76-fghh\">Collabora: advisory GHSA-g3vx-3m76-fghh\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fgithub.com\u002FCollaboraOnline\u002Frichdocumentscode\u002Fissues\u002F354\">richdocumentscode, issue #354\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fwww.collaboraonline.com\u002Fblog\u002Fstay-safe-upgrade-everything-regularly\u002F\">Collabora: post of October 15, 2026\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fhelp.nextcloud.com\u002Ft\u002Fto-collabora-built-in-user-update-asap\u002F250516\">Nextcloud forum: updating the built-in CODE server\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers\u002F\">BleepingComputer: attack timeline\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fdocs.nextcloud.com\u002Fserver\u002Flatest\u002Fadmin_manual\u002Focc_apps.html\">Nextcloud: occ commands for apps\u003C\u002Fa>","A fleet of client Nextclouds under control","You keep the relationship with each client; ServOrbit.com keeps the infrastructure. A single space to see each client's servers, renewals and security, instead of an inventory rebuilt in a hurry.","Explore the agency offer","\u002Fsolutions\u002Fagences",[156,177,195],{"id":157,"slug":158,"slugs":159,"title":163,"excerpt":164,"readTime":17,"views":18,"isPinned":19,"publishedAt":165,"updatedAt":166,"category":167,"categories":173,"featuredImage":30,"bgImage":31,"posterImage":175,"relatedSolution":176},441,"office-2021-eol-collabora-online-or-onlyoffice-vps",{"fr":160,"en":158,"ar":161,"es":162},"nextcloud-collabora-onlyoffice-office-2021-eol","office-2021-eol-collabora-online-ou-onlyoffice","office-2021-eol-collabora-online-o-onlyoffice-vps","Office 2021 EOL: Collabora Online or OnlyOffice on VPS","Office 2021 receives no more security patches since October 13, 2026. Deploy Collabora Online or OnlyOffice as a Nextcloud sidecar on your VPS.","2026-10-14T00:00:00+00:00","2026-10-14T23:33:30+00:00",{"id":168,"name":169,"slug":170,"color":171,"icon":172},7,"Self-hosting","self-hosting","bg-indigo-500\u002F10 text-indigo-400","cloud",[174],{"id":168,"name":169,"slug":170,"color":171,"icon":172},"\u002Fblog\u002Fcovers\u002Fnextcloud-collabora-onlyoffice-office-2021-eol-poster.svg",{"categorySlug":34,"appSlug":35},{"id":178,"slug":179,"slugs":180,"title":184,"excerpt":185,"readTime":186,"views":187,"isPinned":19,"publishedAt":188,"updatedAt":189,"category":190,"categories":191,"featuredImage":30,"bgImage":31,"posterImage":193,"relatedSolution":194},71,"hosting-nextcloud-on-your-own-vps",{"fr":181,"en":179,"ar":182,"es":183},"heberger-nextcloud","استضافة-nextcloud-على-خادمك-الـvps-الخاص","alojar-nextcloud-en-su-propio-vps","Self-Host Nextcloud on VPS: NC 35, PHP 8.3 and MariaDB 11 Guide","Host Nextcloud on a VPS: Docker Compose, Redis, MariaDB backup, uploads over 40 GB behind Cloudflare and an alternative to Office 2021.",20,1,"2026-04-10T00:00:00+00:00","2026-10-23T13:27:09+00:00",{"id":168,"name":169,"slug":170,"color":171,"icon":172},[192],{"id":168,"name":169,"slug":170,"color":171,"icon":172},"\u002Fblog\u002Fcovers\u002Fheberger-nextcloud-poster.svg",{"categorySlug":170,"appSlug":35},{"id":196,"slug":197,"slugs":198,"title":202,"excerpt":203,"readTime":204,"views":187,"isPinned":19,"publishedAt":205,"updatedAt":206,"category":207,"categories":208,"featuredImage":30,"bgImage":31,"posterImage":210,"relatedSolution":30},489,"php2shell-cve-2026-109618-109619-patch-php",{"fr":199,"en":197,"ar":200,"es":201},"php2shell-cve-2026-109618-109619-mettre-a-jour-php","php2shell-cve-2026-109618-109619-تحديث-php","php2shell-cve-2026-109618-109619-actualizar-php","PHP2Shell: patch CVE-2026-109618 and CVE-2026-109619","PHP2Shell: two critical PHP flaws exploitable without an account. Patched versions, update commands per system and temporary mitigations.",16,"2026-10-22T00:00:00+00:00","2026-10-27T23:58:43+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[209],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fphp2shell-cve-2026-109618-109619-mettre-a-jour-php-poster.svg",1793145973036]