An unauthenticated attacker can run OS commands on your server through the "Collabora Online – Built-in CODE Server" app whenever its document server isn't running. Web shells have been found planted on real servers since September. This free 30-second self-test tells you if you're at risk. No signup, nothing installed.
Check your app version — SSH into your Nextcloud server and run:
sudo -u www-data php occ app:list | grep richdocumentscode
Check for signs of past compromise — search your web logs for hits to the vulnerable endpoint around any restart or upgrade window:
grep "proxy.php" /var/log/apache2/access.log | grep -v " 200 "
Also look for PHP files you didn't put there inside your Nextcloud directories — three admins found web shells this way before the CVE was even published.
This page checked one CVE. BreachHunter continuously scans your entire site and explains every finding in plain English.
Drop a live version-checker into your blog, docs, or forum post — three lines of HTML.
Get the embed code