Mapping Internet-Facing Nextcloud and Built-in CODE Exposure
Mapping Internet-Facing Nextcloud and Built-in CODE Exposure CVE-2026-110447 gives exposure analysts a concrete string to search and a strict limit on what the result can mean. The affected app is richdocumentscode, the built-in CODE server for Nextcloud. A public query can find pages that mention the application. It cannot determine the installed version, confirm that proxy.php is reachable in…
Nextcloud's built-in CODE server can be exposed via the internet, presenting a security vulnerability. The affected app is richdocumentscode. A public query can uncover pages mentioning the application, but it can't determine the installed version, verify the vulnerable state, or identify a compromised host. On November 5, 2026, ZoomEye found 122,126 all-asset matches for the application, 109,876 with the title "Nextcloud richdocumentscode", and 20 with the exact endpoint string "richdocumentscode/proxy.php".
Each query type yields distinct results, each useful for separate purposes. The broad application name search is a discovery tool, while the title and endpoint queries help narrow the search to specific pages and confirm the presence of the vulnerable version of richdocumentscode. Validation must occur separately, with the owner confirming Nextcloud installation, the vulnerable version, internet-facing status, and the CODE server being in the stopped state to enable exploitation.
Asset records should carry source and confidence levels. Mixing different types of evidence without clear labels leads to an overestimation of certainty. The report suggests classifying the visible surface, prioritizing internet-facing Nextcloud instances, and focusing remediation efforts on those hosts. Verification should include checking the restart/crash/deployment records, access logs for proxy paths, and filesystem checks for unexpected PHP files.
The advisory emphasizes that standalone Collabora Online servers are not affected, and disabling the app is not a solution. The final recommendation is to monitor without inflating the count, using the same query and scope for recurring checks, and preserving evidence for investigation if a host was exposed before the fix.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.