Straight answers, no panic. A critical flaw in one optional Nextcloud app was exploited against real servers in September and October 2026. Here is what happened, whether you are affected, and exactly what to do.
Nextcloud itself remains actively maintained, but in 2026 a critical vulnerability (CVE-2026-110447) in the optional “Collabora Online – Built-in CODE Server” app allowed unauthenticated remote code execution and was exploited in the wild. If you keep Nextcloud and its apps updated — the fix is richdocumentscode 26.4.303 or newer — and follow the compromise checklist after any exposure window, a self-hosted Nextcloud is as safe as any maintained platform.
An operating-system command-injection flaw in the built-in Collabora CODE server's proxy.php. When the app's local document server is not running — for example during a restart or upgrade — an unauthenticated request can execute OS commands as the web server user. Attackers planted PHP web shells on real servers and searched them for credential stores and crypto wallets. The fix was released September 11, 2026; the CVE advisory followed October 14, 2026.
Only if you have the “Collabora Online – Built-in CODE Server” (richdocumentscode) app installed at a version below 26.4.303. Standalone Collabora Online servers — Docker, Linux package, or hosted — are not affected. Check yours:
sudo -u www-data php occ app:list | grep richdocumentscode
shx*.php). Review web logs from September 2026 onward for requests to proxy.php.The full self-test walks you through the exact commands, step by step. No signup, nothing installed.