CVE-2026-110447 — published October 14, 2026 — names a critical command-injection flaw in Collabora’s built-in CODE app that attackers used to plant web shells on Nextcloud servers, with the first logged exploit activity recorded on September 10, 2026.
How the Collabora built-in CODE app allowed web shells
The vulnerable component is the Nextcloud app published by Collabora under the package name richdocumentscode, marketed in the app store “for local testing and non-production use” and “for personal use or for small teams.” The app downloads a copy of Collabora Online Development Edition (CODE) and runs it on the Nextcloud host so that documents can be edited without a separate Collabora server.
In versions up to 26.4.302, the app’s proxy.php script started the local CODE server by embedding text taken from incoming web requests inside a double‑quoted bash command. Because bash expands constructs such as $(...), an attacker could hide a command in the request path; when the server was not running — for example during a restart, upgrade, or crash — a request arriving at /apps/richdocumentscode/proxy.php?status could trigger the vulnerable start-up path and run that command as the web server user. The proxy.php file itself is a plain PHP script served directly from the app folder and does not load Nextcloud’s code.
Observed attacks, indicators, and forensic traces
Three Nextcloud administrators reported compromises on GitHub and in community threads. Access logs from two servers show exploit requests at 19:51 on September 10 and 09:56 on September 11 (UTC+2) coming from IP 139.28[.]18[.]122, aimed at proxy.php?status with a shell command encoded in the path. A September 14 attempt against a patched server came from 89.38[.]98[.]50.
Attackers decoded a one‑line PHP web shell into the app’s folder and attempted to send uname -a output to a webhook.site callback (IDs 45060ed4-de0b-4119-8f0d-2a2776bbd413 and 774cf5e1-b5a4-4174-a1ad-0241861029a2). Filenames reported by administrators include shrf4645.php, shxa35d0.php, shx5cf91.php, shxd33ce.php, shxf4645.php (found under apps/richdocumentscode/), and shx13a86.php; a later payload used the name shx56367.php but created no file. The one‑line shell’s SHA‑256 hash reported is 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562, corresponding to the PHP snippet &1');
Log markers administrators were advised to search for include %2e%2e, $(, ${{IFS}}, and instances of base64 -d piped to sh. One administrator observed the attacker using the web shell to look for credential stores and cryptocurrency wallets (patterns such as *.kdbx, wallet.dat, keystore.json and names including bitwarden, 1password, .bitcoin, .electrum, .monero, .ethereum). The reports show no evidence of root access; however, Collabora and the reporting administrators warned that any file readable by the web server account should be treated as potentially exposed.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadWho is affected: richdocumentscode users and legacy Nextcloud installs
Collabora’s advisory covers all versions of richdocumentscode before 26.4.303 and states that standalone Collabora Online servers are not affected. The app store continues to serve affected versions to Nextcloud 29 and older; because the fixed version 26.4.303 requires Nextcloud 30 or later, installations still on Nextcloud 29 or earlier cannot install the patched app and must either upgrade Nextcloud or remove the app. A warning posted on the Nextcloud community forum on October 3 said installations that use only the Nextcloud Office app (richdocuments) and not the built-in app are not affected, whether their Collabora server runs in Docker, from a Linux package, or at a hosting provider.
What Collabora changed and the release timeline
The code change that closed the flaw is small: four lines in proxy.php now hand the start command to bash as a single escaped argument so the shell will not expand text taken from the request. The repository’s commit record shows that Caolán McNamara wrote the change on August 20; it was committed on September 9. That commit did not appear in version 26.4.302 (released August 31). The first logged attack occurred on September 10 and version 26.4.303 followed on September 11. Collabora published its advisory and CVE on October 14, 2026. The advisory explicitly warns that disabling the app is not sufficient — the app must be updated to 26.4.303 or removed.
Recommended actions for administrators, technologists, and end users
- Administrators: update richdocumentscode to 26.4.303 or later, or remove the app. Disabling the app does not mitigate the flaw.
- Operators on Nextcloud 29 or older: either upgrade Nextcloud to a supported version that can run 26.4.303 or remove the built-in CODE app, because the app store will still serve affected builds to older Nextcloud releases.
- If you already updated: search your installation beginning in apps/richdocumentscode for shx*.php files and delete any found; review access logs back to at least September 10 for proxy.php?status requests whose path contains %2e%2e, $(, ${{IFS}}, or base64 -d | sh; and check for sudo attempts by the web server account. Treat any file the web server account could read as potentially exposed.
- Note: Collabora released version 26.4.402 on September 24 which rewrote the start command to pass options as separate arguments; administrators reported that 26.4.402 fails to start or to open documents on some setups and have reverted to 26.4.303, the version named in the advisory.
The exploit sequence recorded by administrators makes clear that timing — when the local CODE server is down — mattered as much as the code bug itself. Collabora’s advisory and the CVE close the technical hole, but the practical work for hosts of affected Nextcloud instances remains straightforward and immediate: update or remove the app, hunt for leftover web shells, and treat exposed data as compromised. How many servers were impacted in total remains unknown.
