Cybersecurity

Nextcloud CODE Server Flaw: What Indian Firms Must Do Now

Affix Center · · 6 min read

Red padlock resting on a black computer keyboard

In short: A critical command injection flaw, CVE-2026-110447, in the built-in Collabora CODE server app for Nextcloud is being used to plant web shells on servers. On 23 October 2026 the US agency CISA added it to its list of exploited flaws. If you self-host Nextcloud with this app, update to version 26.4.303 or remove the app now.

Many Indian companies, colleges and government offices run Nextcloud as a private alternative to public file-sharing services. Some also enable the built-in Collabora CODE server so staff can edit documents in the browser. If that app is out of date, attackers may already have a way in.

What Happened

According to BleepingComputer's report of 15 October 2026, the flaw is an OS command injection bug in the "Collabora Online - Built-in CODE Server" app (also called richdocumentscode). The advisory and CVE were published on 14 October. The fix was released earlier, in version 26.4.303 on 11 September 2026.

The report says administrators described attacks against multiple servers from around 10 September, and a community warning appeared on the Nextcloud help forum on 3 October. Attackers planted PHP web shells and used them to search for password databases, password manager files and cryptocurrency wallets. Some users claimed ransomware groups were involved, but BleepingComputer could not confirm this.

The Hacker News reported on 24 October 2026 that CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on 23 October, with a CVSS score of 9.2, and asked US federal agencies to fix it by 26 October.

Who Is Affected

Based on the vendor statements in these reports:

  • Affected: Nextcloud servers that have the built-in CODE server app (richdocumentscode) installed at a version before 26.4.303.
  • Not affected, per Collabora: standalone Collabora Online servers, Docker and RPM or DEB installations, and Nextcloud All-in-One deployments.

The attack works when the built-in CODE server is not running, for example after a restart, an upgrade or a crash. A request to the app's proxy.php file can then run commands on the server. No login or user action is needed. Nextcloud said it had not seen widespread exploitation, but the CISA listing confirms attacks are real.

What It Means for Indian Businesses and Departments

Self-hosted file servers often hold contracts, HR records, tender documents and citizen data. A web shell on such a server can expose all of it and give attackers a base to move further into the network. Organisations covered by the CERT-In directions of April 2022 must report specified cyber incidents within six hours of noticing them, so a confirmed compromise is also a reporting question. Personal data exposure may raise duties under the Digital Personal Data Protection Act. Check your obligations with your legal adviser.

The bigger lesson is that optional add-on apps are easy to forget in patch cycles. A server may be patched for the main application while an add-on sits months behind.

What to Do Now

  1. Find every Nextcloud server: list all instances, including test servers and ones run by individual departments, and note whether the built-in CODE server app is installed.
  2. Update or remove the app: update richdocumentscode to 26.4.303 or later; if you do not need it, remove it, because the vendor says disabling the app is not enough.
  3. Check for web shells: look for unexpected PHP files in the Nextcloud and app folders, and review web server logs for unusual requests to proxy.php since September.
  4. Treat suspicious servers as compromised: if you find signs of intrusion, isolate the server, preserve logs and follow your incident response plan, including CERT-In reporting where it applies.
  5. Rotate secrets: change passwords, API keys and tokens stored on or used by an affected server, starting with admin and service accounts.
  6. Limit exposure: place Nextcloud behind a VPN or web application firewall where possible, and keep only the apps you actually use.
  7. Add add-on apps to patch tracking: include every installed Nextcloud app in your monthly patch review, not just the core server.

Our guide to a patch management process explains how to stop add-ons slipping through, and the CERT-In 6-hour incident reporting checklist helps if you need to report.

Frequently Asked Questions

Is every Nextcloud server at risk?

No. According to the reports, only servers with the built-in CODE server app (richdocumentscode) before version 26.4.303 are affected. Standalone Collabora Online, Docker, RPM or DEB installs and Nextcloud All-in-One are not affected, per Collabora.

Is disabling the app enough?

No. The vendor warned that disabling the app is not sufficient. Update it to 26.4.303 or later, or remove it if you do not need it.

We updated in October. Could we still have been attacked?

Yes. Attacks were reported from around September, before many servers were updated. Check for unexpected PHP files and unusual proxy.php requests even if you are now on the fixed version.

How Affix Center Can Help

Affix Center helps Indian organisations find exposed servers, apply urgent patches and check for signs of compromise. Our cybersecurity services cover vulnerability checks and incident support, and our IT operations team can take on routine patching so add-on apps are not missed. If you run Nextcloud and are unsure whether you are affected, contact us today.