Exploited in the wildCRITICALCISA KEV

Collabora built-in CODE app for Nextcloud exploited for unauthenticated RCE and webshells

An unauthenticated command injection in the richdocumentscode app's proxy.php has been used since 2026-09-10 to plant PHP webshells on Nextcloud servers. Upgrade to 26.4.303 or remove the app, then hunt for shx*.php files. Disabling the app is not enough.

Collabora Online Built-in CODE Server (Nextcloud app richdocumentscode)CVE-2026-110447CVSS9.2CWE-78Collaboration
Published Oct 24, 2026

Administrator logs on Collabora's issue tracker show exploitation since 2026-09-10, which planted PHP webshells on several Nextcloud servers. CISA added the CVE to KEV on 2026-10-23 2,3.

Aug 31, 202653 daysOct 23, 2026

What you need to know

  • Affects Nextcloud servers running the richdocumentscode (built-in CODE) app at 26.4.302 or older. Standalone Collabora servers and richdocuments-only setups are not affected.
  • An unauthenticated request to proxy.php can run OS commands as the web server user. This works only while the bundled CODE server is not running.
  • Exploited since 2026-09-10 to drop PHP webshells and search for password databases and crypto wallets. The CVE is in CISA KEV with a due date of 2026-10-26.
  • Upgrade to 26.4.303 or remove the app. Disabling the app leaves it exposed, and patching does not remove webshells already planted.
  • Hunt for shx*.php files in apps/richdocumentscode/. In access logs, look for proxy.php?status requests whose path contains %2e%2e, $( or ${IFS}.

What's happening

CVE-2026-110447 is an unauthenticated OS command injection in proxy.php of richdocumentscode, the Nextcloud app that bundles the built-in Collabora Online Development Edition (CODE) server 1. A crafted request runs an operating-system command as the web server user 1. All releases before 26.4.303 are affected, and 26.4.303 contains the fix 1. The flaw is in how the Nextcloud app launches the bundled server, not in Collabora Online itself 1.

The exposure is narrower than every Nextcloud server with Collabora. Standalone Collabora Online servers are not affected, and neither are Nextcloud instances that use only the richdocuments connector 7. BleepingComputer, citing Collabora, also lists Nextcloud All-in-One as unaffected 6. Censys counted 19,454 hosts exposing the app on 2026-10-16 8. That figure measures app presence, not confirmed vulnerable hosts 8. Disabled installs remain exposed. On one server, requests still reached proxy.php of a deactivated app 1.

Exploitation began before disclosure. The earliest logged attack, from 139.28.18.122, is dated 2026-09-10 3. That was one day before 26.4.303 shipped without a security notice and about a month before the advisory and CVE on 2026-10-14 1,5. Several independent administrators reported the same attack pattern and webshell family 3. On one server the attacker searched for password-manager databases and crypto-wallet artifacts 3. No report shows the attacker gaining root 5. The CVE record says exploitation continued into October 2026 4. Only the 2026-09-10 to 2026-09-14 attacks have dated public logs 3,5. CISA added the CVE to KEV on 2026-10-23 with a due date of 2026-10-26 and lists ransomware use as unknown 2. No vendor, government agency or IR firm has named an actor.

How it works

The bug is a CWE-78 command injection 1. When a request reaches proxy.php and no CODE server is listening, the script starts the bundled server 5. Up to 26.4.302, it built that launch command as a shell string 5. The string included request-derived text, including the URL path, without safe escaping 5. proxy.php is a standalone PHP file that runs without loading Nextcloud code 5. The attack needs no authentication and no user interaction, only network access to the endpoint 6.

The attack works only when the built-in CODE server is not running, for example after a container restart, an upgrade or a crash 1. The CVSS 4.0 vector marks this condition with AT:P 1. The Collabora maintainer says the issue affects only the Development Edition in built-in CODE Server mode, which downloads a local AppImage 3. This is a separate flaw from CVE-2025-66208, and the fix for that CVE does not prevent this one 1.

The fix is a small change to proxy.php. The launch command is now passed to bash as a single escaped argument instead of an interpolated string 5. The commit was authored on 2026-08-20 and committed on 2026-09-09 under the title "tidy up how the coolwsd launch command is built" 5. Collabora's advisory names only richdocumentscode 8. Censys counted 1,001 exposed hosts referencing the separate richdocumentscode_arm64 app, and the vendor has not said whether that app shares the flaw 8.

What to do

In order of priority
  1. 1

    Upgrade richdocumentscode to 26.4.303 or later, or remove the app 1. Disabling it in Nextcloud does not remove the exposure 1.

  2. 2

    Instances on end-of-life Nextcloud 29 or older cannot install 26.4.303 1. Upgrade Nextcloud to version 30 or later, or remove the app 1.

  3. 3

    26.4.402, released 2026-09-24, rewrote the start command 5. Some administrators reported that it failed to start or open documents and rolled back to 26.4.303, the version the advisory names as the fix 5.

  4. 4

    Consider moving to a standalone Collabora server (Docker or distro package) or a hosted Collabora instance 7. Both avoid the vulnerable built-in deployment mode 7.

  5. 5

    Treat any server that ran 26.4.302 or older on or after 2026-09-10 as possibly compromised and investigate it 3,5. Delete leftover shx*.php files, because patching does not remove them, then review logs for signs of exploitation 5.

  6. 6

    Treat everything the web server account could read as potentially exposed, including database credentials, app passwords and stored secrets 5. On servers with signs of compromise, rotate those credentials.

  7. 7

    Under CISA KEV, US federal agencies must apply vendor mitigations by 2026-10-26, in line with BOD 26-04 and its forensic triage requirements 2. If mitigations are unavailable, they must stop using the product 2.

Detection

  • Inventory every Nextcloud instance for richdocumentscode, including disabled installs. Disabling the app does not stop requests from reaching proxy.php 1. Treat any version below 26.4.303 as exposed 1.
  • Search the filesystem for unexpected shx*.php files, starting in apps/richdocumentscode/ 5. One forum user reported a different name pattern, Nx_33143.php, in the same directory 7.
  • Run Nextcloud's built-in integrity check. It flagged an EXTRA_FILE in richdocumentscode on two compromised servers 8. Treat any unfamiliar PHP file in the app directory as suspect 8.
  • Review web access logs back to at least 2026-09-10 5. Look for requests to /apps/richdocumentscode/proxy.php?status whose path contains %2e%2e, $( or ${IFS} 5.
  • Look for GET requests to unfamiliar PHP files in the app directory that carry a c parameter. The first reporter saw repeated checks using ?c=id 3.
  • Check egress and proxy logs for outbound requests from the Nextcloud host to webhook.site. In observed attacks, the injected command sent uname -a output there 3.
  • Review auth logs for sudo attempts by the web server account. One administrator learned of the compromise from emails about failed sudo attempts 5.
  • A Nuclei template for this CVE was under review as of 2026-10-21 (PR #17434) 9. Its contents are unverified, so review it before using it to validate exposure.

Indicators

As published by the cited sources
TypeValueContext
url path/apps/richdocumentscode/proxy.php?statusLegitimate path. Suspicious only with encoded traversal or shell metacharacters in the request path.3
file path/apps/richdocumentscode/shx*.phpWebshell filename pattern reported by administrators.3
file pathapps/richdocumentscode/shrf4645.phpWebshell found on the first reporter's servers.5
file pathapps/richdocumentscode/shxa35d0.phpWebshell found on the first reporter's servers.5
file pathapps/richdocumentscode/shx5cf91.phpWebshell found on the first reporter's servers.5
file pathapps/richdocumentscode/shxd33ce.phpWebshell found on the first reporter's servers.5
file pathshx13a86.phpWebshell found by a second administrator. Location not stated.5
file pathapps/richdocumentscode/Nx_33143.phpExtra file flagged by the integrity check. Single forum report, different naming pattern from shx*.7
sha2564b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562One recovered webshell sample, as published by the issue reporter.3
ip139.28.18.122Source of the 2026-09-10 and 2026-09-11 attack requests.3
ip89.38.98.50Source of the 2026-09-14 attempt against a server already on 26.4.303.5
domainwebhook.siteLegitimate public service used to receive uname output. Use it as a hunting pivot, not a blocklist entry.3

Timeline

  1. richdocumentscode 26.4.302 released (vulnerable). 5

  2. Fix committed to the repository with no security announcement. 5

  3. First logged exploitation, from 139.28.18.122. Webshells planted. 3

  4. 26.4.303 released with the fix but no security notice. A second attack from the same IP was logged the same day. 5

  5. Attempt from 89.38.98.50 against a server already on 26.4.303. No shell file was created. 5

  6. 26.4.402 released with a rewritten start command. Some administrators reported compatibility problems. 5

  7. Nextcloud community forum post warns that exploitation is under way before any CVE exists. 7

  8. Collabora publishes advisory GHSA-g3vx-3m76-fghh, and CVE-2026-110447 is published. 1

  9. Censys advisory counts 19,454 hosts exposing the app. 8

  10. CISA adds the CVE to KEV with a due date of 2026-10-26. 2

Sources

  1. 1
    Unauthenticated OS command injection in the richdocumentscode proxy
    Collabora (GitHub Security Advisory) · Vendor · Oct 14, 2026
  2. 2
    CISA KEV entry for CVE-2026-110447
    CISA · Government · Oct 23, 2026
  3. 3
    Security issue - Hack (richdocumentscode issue #354)
    Collabora / affected administrators (GitHub) · Vendor
  4. 4
    GitHub Advisory Database entry for CVE-2026-110447
    GitHub Advisory Database · Database · Oct 14, 2026
  5. 5
    Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora's Built-in CODE App
    The Hacker News · News
  6. 6
    Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
    BleepingComputer · News
  7. 7
    To Collabora Built-in User: Update ASAP
    Nextcloud community forum · Research · Oct 3, 2026
  8. 8
    Oct 16 Advisory: Collabora Online Built-in CODE Server OS Command Injection
    Censys · Research · Oct 16, 2026
  9. 9
    Add CVE-2026-110447 Collabora CODE command injection template
    ProjectDiscovery (GitHub) · Research · Oct 21, 2026

Corroborated by independent sources. Researched and drafted by the VulnDigest briefs agent from 9 sources, then checked against them by a separate review step on Oct 24, 2026.

Collabora's advisory does not say the flaw was exploited. The evidence comes from administrator logs in the project's issue tracker, from news reports and from CISA KEV.

Public logs cover attacks from 2026-09-10 to 2026-09-14. The CVE record says exploitation continued into October, but no dated October evidence is public.

Ransomware use is unconfirmed. CISA lists it as unknown, and BleepingComputer could not confirm user reports of ransomware activity.

Censys dates the first malicious request to 2026-09-16. The published logs show 2026-09-10, which this brief uses.

Collabora has not said whether the separate richdocumentscode_arm64 app is affected.

26.4.402 is newer, but administrators reported problems with it. The advisory names 26.4.303 as the fix.

Spotted an error? Open an issue on sochub.io.