CVE-2026-110447 — THE EOL TRAP

The Nextcloud CVE EOL trap: stuck on version 29? — a cybersecurity news escape check

The Nextcloud EOL trap is the dead end where versions 29 and older keep receiving the vulnerable Collabora app because the fixed version requires Nextcloud 30 or newer. This cybersecurity news check shows how to confirm your version and plan the upgrade in 60 seconds.

Reviewed October 18, 2026 — Ingenious AI security check.

Are you stuck in the Nextcloud EOL trap this cybersecurity news cycle?

If you are on Nextcloud 29 or older, yes — and the app store will not save you. The vulnerable Collabora app is still served to end-of-life versions, while the patched app demands Nextcloud 30+. Run the version command below, then plan the upgrade path the check lays out: backup, staged upgrade, and verifying the fixed Collabora build lands.

What is an EOL trap?

When software reaches end of life but its ecosystem keeps serving vulnerable components — here, Nextcloud 29 and older still receiving the unpatched Collabora app because the fix requires Nextcloud 30 or newer.

Here's the nasty part nobody put on a poster: Nextcloud 29 and older are end of life — and the app store still serves them the vulnerable Collabora app. The fixed app version requires Nextcloud 30+. So if you're on 29, there is no safe version of the app you can install. Type your version into this Nextcloud CVE checker to see where you stand.

Version check

Find yours with: sudo -u www-data php occ --version — then enter it below (e.g. 29.0.5, 31.0.2).

Why the trap exists

Nextcloud 29 and older are end of life. No more security updates, full stop.
The app store still serves these EOL versions an affected richdocumentscode — so a routine "update all apps" can install the vulnerable code on a server that can never be patched for it.
The fixed app (26.4.303) requires Nextcloud 30 or later. There is no patched build for 29.
Your two honest exits: upgrade Nextcloud to a supported release, or remove the built-in CODE Server app entirely. Disabling it does not protect you either way.

Sources: The Hacker News · CyberPress · Censys · help.nextcloud.com maintenance post

On a supported version?

Good — now make sure October's updates actually land. One checklist covers the Hub updates and the CODE fix together:

Open the October patch planner →

Exposure quiz · Webshell-leftovers hunt

FROM INGENIOUS AI

Ingenious AI builds 11 AI security platforms — disclosure compliance, rogue-agent defense, breach hunting, agent oversight, and more.

All 11 platforms: DisclosureGuard · ModelMinder · TermsWatch · Vibe-Code Audit · Rogue-Agent Defense · BreachHunter · ChatBreaker · Agent Flight Recorder · Agent Auth Gateway · DomainGuard · ContentCraft AI

Our platforms are being upgraded and return November 1 — get early access now:

Get early access on WhatsApp →

Is Nextcloud 29 still supported?

No. Nextcloud 29 and older are end of life and no longer receive security updates. Worse, the app store still serves these versions the vulnerable richdocumentscode app, and the fixed version 26.4.303 requires Nextcloud 30 or later — so there is no safe app version available for Nextcloud 29 and older.

I'm on Nextcloud 29 — how do I fix CVE-2026-110447?

You have two honest paths: upgrade Nextcloud to a supported release (30 or newer) and then update the built-in CODE app to 26.4.303+, or remove the built-in CODE Server app entirely. Disabling the app does not fix it, and no patched app version exists for Nextcloud 29.

What Nextcloud versions get the October 2026 maintenance updates?

Nextcloud Hub 26 Winter updates to 33.0.10, Spring to 34.0.5, and Summer to 35.0.2, per the October 16, 2026 maintenance announcement. The rollout is staged, starting at 30% of instances.

Is Nextcloud safe?

Nextcloud itself remains safe to use when kept updated — the October 2026 incident was a critical flaw (CVE-2026-110447) in one optional app, the built-in Collabora CODE server, not in Nextcloud core. Stay on a supported release, apply maintenance updates promptly, and remove apps you do not use.

How do I check if my Nextcloud is vulnerable?

Check whether the ‘Collabora Online – Built-in CODE Server’ app (richdocumentscode) is installed and older than 26.4.303 — via Admin > Apps or ‘occ app:list’. If the app was present at any point in September–October 2026, assume exposure and hunt for web shells even after patching.

What should I do if my Nextcloud was hacked?

Take the server offline, restore from a clean backup or rebuild it, and rotate every credential the server touched. Hunt for leftover PHP web shells — patching CVE-2026-110447 does not remove shells attackers already planted — then update the Collabora app to 26.4.303+ or remove it.