Publication of a 0-day PoC for a Nextcloud vulnerability (CVE-2026-110447)

For informational purposes only.

Nextcloud is a platform for file storage, synchronization, and collaboration that can be deployed on your own server. CODE is its development version, which can also be installed as a Nextcloud app.

The proxy.php endpoint in the richdocumentscode app is vulnerable to operating system command injection. The vulnerability occurs when the CODE server is not running—for example, after a restart, update, or crash. The vulnerability exists because the proxy.php script inserts the request text, including the URL path, into a Bash command inside double quotes. This allows an unauthenticated attacker to execute arbitrary code using a $(...) sequence in the URL path.

Vulnerability type: RCE Affected versions: before 26.4.303