🔴 LIVE ADVISORY — CVE-2026-110447 · EXPLOITED IN THE WILD
Is your Nextcloud server exposed to CVE-2026-110447?
Unauthenticated remote code execution via the Collabora built-in CODE Server app. Web shells were planted on real Nextcloud servers in September–October 2026. Fixed in richdocumentscode 26.4.303 — and disabling the app does not help.
What this check does
1. Fingerprints
Detects Nextcloud via status.php and the login page — the same public signals anyone can see.
2. Probes the app surface
Checks whether the richdocumentscode proxy.php endpoint is reachable and harvests any visible version.
3. Gives a verdict
EXPOSED, LIKELY SAFE, or COULD NOT CONFIRM — with the exact remediation, never a compromise claim.
Frequently asked questions
What is CVE-2026-110447?
CVE-2026-110447 is an unauthenticated OS command injection in proxy.php of the Nextcloud app "Collabora Online – Built-in CODE Server" (richdocumentscode) before version 26.4.303. An unauthenticated request can run OS commands whenever the app's local document server isn't running — during a restart, upgrade, or crash. It was exploited in the wild in September–October 2026, with web shells planted on real servers.
Does disabling the Collabora app protect my server?
No. Turning the richdocumentscode app off does not remove the vulnerable proxy.php endpoint. Per the Nextcloud advisory, you must update the app to 26.4.303 or newer, or remove the app entirely. Disabling alone leaves the exposure in place.
Is this check safe to run against my server?
Yes. The check is fully passive: it fetches only public endpoints (status.php, the login page, the app's proxy.php surface) with plain GET requests carrying no payloads. It touches nothing, changes nothing, and cannot confirm compromise — it reports exposure only.
What do I do if my server is exposed?
Update richdocumentscode to 26.4.303+ immediately, or remove the app. Then hunt for compromise: unexpected PHP files in Nextcloud directories, proxy.php hits in web logs around CODE-server restarts, unfamiliar admin users or cron entries. If anything hits, treat the box as compromised and rebuild from known-good media — patching alone doesn't remove an already-planted web shell.
This free check covers one CVE. BreachHunter's full scan covers your entire site — recon, ports, TLS, web audit, edge appliances — scored 0–100 with plain-English fixes. See Pro →