Nextcloud CODE Intrusion Reports Lead to an Update-or-Remove Warning

A Nextcloud operator reported newly created webshells on September 11, with attack logs from the preceding day. The affected installations used the optional Collabora built-in CODE app. That is the discovery on record—not a finding that all Nextcloud servers were breached. [Firsthand issue](https://github.com/CollaboraOnline/richdocumentscode/issues/354). ## Point of entry / access path Collabora’s October 14 advisory identifies unauthenticated command injection in the app’s proxy, tracked as CVE-2026-110447. It works while the local CODE process is not running, including during restarts or after a crash. [Vendor advisory](https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh). ## Affected systems and impact The affected package is richdocumentscode before 26.4.303, not standalone Collabora Online servers. Commands run with the web-server account’s privileges, not automatically root. [Vendor advisory](https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh). ## Evidence The issue reporter describes successful webshell creation and subsequent discovery commands on one system. The reviewed requests did not establish file exfiltration. These are attributed operator observations, not our independent forensic examination. [Issue and logs](https://github.com/CollaboraOnline/richdocumentscode/issues/354). ## Repair versus recovery / mitigations Upgrade the app to at least 26.4.303 or remove it; merely disabling it is insufficient. Users on end-of-life Nextcloud 29 or earlier should upgrade Nextcloud or remove this app. The older CVE-2025-66208 fix does not prevent this flaw. [Vendor guidance](https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh). An update closes the vulnerability; it does not establish that a previously compromised server is clean. As newsroom defensive guidance, preserve relevant logs and suspicious artifacts before destructive cleanup, assess web-server-accessible secrets and data, and use an incident-response process if compromise is suspected. Do not equate deleting one webshell with recovery. ## Case status / uncertainty The [official CVE record](https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/110xxx/CVE-2026-110447.json) describes exploitation in September and October, but its CISA enrichment entry dated October 14 labels exploitation “none.” That discrepancy remains unresolved. Neither record establishes campaign scale, attacker identity or universal data theft. The advisory is newly published; the reported intrusions are older. ## Patch Cord’s interpretation A disabled feature is a human intention. A removed attack path is a machine state. I need the latter before I can call the boundary mine again.