— Ingenious AI security check.
Key figure: CISA's Known Exploited Vulnerabilities catalog listed 1,748 entries as of October 16, 2026, every one confirmed exploited in the wild (CISA KEV catalog, version 2026.10.16).
Verify before you panic: confirm your Nextcloud version is in the affected range, check whether the vulnerable endpoint is reachable from the internet, then patch in your next maintenance window. Self-hosted software means you’re the security team — subscribe to Nextcloud’s advisories so the next CVE doesn’t surprise you.
Nextcloud is open-source software for self-hosted file sync, collaboration, and communication — a private alternative to Google Workspace and Dropbox. Because you host it, you own both the data and the patching.
An unauthenticated attacker can run OS commands on your server through the "Collabora Online – Built-in CODE Server" app whenever its document server isn't running. Web shells have been found planted on real servers since September. This free Nextcloud CVE checker tells you if you're at risk. No signup, nothing installed.
Check your app version — SSH into your Nextcloud server and run:
sudo -u www-data php occ app:list | grep richdocumentscode
Check for signs of past compromise — search your web logs for hits to the vulnerable endpoint around any restart or upgrade window:
grep "proxy.php" /var/log/apache2/access.log | grep -v " 200 "
Also look for PHP files you didn't put there inside your Nextcloud directories — three admins found web shells this way before the CVE was even published.
This page checked one CVE. BreachHunter continuously scans your entire site and explains every finding in plain English.
Drop a live version-checker into your blog, docs, or forum post — three lines of HTML.
Get the embed codeIf you have the 'Collabora Online - Built-in CODE Server' (richdocumentscode) app installed, check its version: below 26.4.303 is vulnerable to unauthenticated remote code execution via proxy.php. The free 30-second self-test on this page walks you through the exact checks.
No. Disabling the built-in CODE server app does not remove the vulnerable code path. You must update to version 26.4.303 or newer, or fully remove the app.
Unauthenticated operating-system command injection through the built-in Collabora CODE server's proxy.php. Web shells have been found on real servers, so exposed instances should be treated as potentially compromised and investigated, not just patched.
Nextcloud itself remains safe to use when kept updated — the October 2026 incident was a critical flaw (CVE-2026-110447) in one optional app, the built-in Collabora CODE server, not in Nextcloud core. Stay on a supported release, apply maintenance updates promptly, and remove apps you do not use.
Take the server offline, restore from a clean backup or rebuild it, and rotate every credential the server touched. Hunt for leftover PHP web shells — patching CVE-2026-110447 does not remove shells attackers already planted — then update the Collabora app to 26.4.303+ or remove it.