THREATFRONTIER

critical Cve 2026 110447 · Exploits

Nextcloud's Built-in Collabora Server Is Being Used to Plant Webshells, and Disabling the App Does Not Fix It

Data graphic: Cover for the Nextcloud Collabora backdoor story, with a giant 9.2 CVSS v4.0 score for an unauthenticated command injection, a CISA KEV CVE-2026-110447 stamp, and three facts: fixed in 26.4.303, KEV due 26 Oct, first logged attack 10 Sep.
AK

Threat intelligence editor · Published Oct 24, 2026, 5:13 PM EDT

Attackers have used a proxy.php command injection in Nextcloud's built-in Collabora CODE server to plant webshells since 10 Sep. Patch to 26.4.303, then hunt.

Attackers have been exploiting an unauthenticated OS command injection in the Collabora Online Built-in CODE Server app for Nextcloud (richdocumentscode) since at least 10 September 2026. CISA added the flaw, CVE-2026-110447, to its Known Exploited Vulnerabilities catalog on 23 October with a due date of 26 October. Every richdocumentscode release before 26.4.303 is affected. The only fixes are to upgrade or to remove the app. Disabling it does not close the hole, and a patched server can still carry a webshell planted earlier.

Who is affected

The vulnerable component is richdocumentscode, the Nextcloud app that downloads and runs a local Collabora Online (CODE) server so that Nextcloud can edit documents without a separate office server. The CVE record and the Collabora advisory both state that the flaw is not present in standalone Collabora Online servers. A Collabora maintainer described it as affecting "only the Development Edition, and only in this (rather rarer) Built-in CODE Server deployment mode that downloads a local appimage."

The Nextcloud community thread that CISA cites also lists setups that are not exposed. These are installs that use the richdocuments app without richdocumentscode, Collabora run through Docker or Linux distribution packages, and hosted Collabora services. That list comes from the forum thread rather than the advisory text, so confirm your own setup by checking whether the richdocumentscode app is installed and which version it is.

You are in scope if richdocumentscode is installed at version 26.4.302 or older, whether or not the app is currently enabled. The advisory also flags Nextcloud 29 and earlier, which are end of life. On those releases, upgrade Nextcloud or remove the app.

What the flaw is

The bug is a CWE-78 OS command injection in proxy.php, scored 9.2 (Critical) under CVSS v4.0 with no authentication or user interaction needed. A crafted request makes the server run a command as the web server user. The CVE record says it can be triggered "when the CODE server isn't running (e.g., the product was recently restarted)." In practice that means the window opens after a restart, an upgrade or a crash. The advisory says this is a different issue from CVE-2025-66208 and that the earlier fix does not stop it.

Exploitation is easy to automate. CISA's SSVC assessment recorded in the CVE record lists exploitation as active, automatable and with total technical impact.

What attackers have done

The first logged attack in the public reports was on 10 September 2026. The Hacker News reports that the attacker hit /apps/richdocumentscode/proxy.php?status with encoded path traversal (%2e%2e), command substitution and base64 piped to sh. The requests wrote one-line PHP webshells named shx*.php into apps/richdocumentscode/. The payload one victim recovered runs a command from a GET parameter and returns the output. Filenames reported so far include shxa35d0.php, shx5cf91.php, shxd33ce.php, shxf4645.php, shx13a86.php, shx56367.php and shrf4645.php. A Nextcloud forum post also names Nx_33143.php.

Reported source IPs are 139.28.18.122 (10 and 11 September) and 89.38.98.50 (14 September). No actor has been named. In the cases described, the shell sent uname -a output to a webhook.site address, and on one server it searched for credential stores and cryptocurrency wallets. The reporter found no sign in the reviewed logs that files were copied or archived, but said anything the web server account can read should be treated as exposed.

The fix shipped quietly. Collabora released 26.4.303 on 11 September, the day a victim opened a GitHub issue about the intrusion, and The Hacker News says the release notes did not mark it as a security fix. The CVE and advisory followed on 14 October, 34 days after the first logged attack. Version 26.4.402, released 24 September, rewrote the start command, but some administrators reported startup and document-opening problems and went back to 26.4.303.

Data graphic: a timeline for the Nextcloud built-in Collabora server flaw, titled "34 days from first attack to CVE". The first logged attack was 10 Sep and the CVE and advisory came 14 Oct. Between them, 26.4.303 was released 11 Sep without a security label and 26.4.402 followed 24 Sep. The flaw was added to CISA KEV on 23 Oct, with a due date of 26 Oct.

Attacks began on 10 September; the fix shipped quietly the next day, but the CVE and advisory took 34 days, and CISA's deadline is 26 October.

What to do

  1. Patch or remove. Update richdocumentscode to 26.4.303 or later, or uninstall it if you do not use it. Do not rely on disabling the app.
  2. Hunt for webshells, even on a patched server. Run the Nextcloud integrity check and look for EXTRA_FILE entries under apps/richdocumentscode. Search the whole web root for stray PHP files, in particular shx*.php, shrf*.php and Nx_*.php. A Collabora maintainer's advice is to upgrade and also remove any lingering shx*.php files. Compare any file you find against the reported SHA-256 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562, but treat a mismatch as inconclusive, since filenames vary between victims.
  3. Read the logs back to 10 September. Look for proxy.php?status requests containing %2e%2e, $(, ${IFS} or base64 -d piped to sh, requests to any file you found in step 2, and sudo attempts by the web server account. Check the logs even if the app was disabled, because the forum thread warns the flaw may have been used regardless.
  4. Rotate secrets. Assume anything the web server account could read is compromised: such as the database password and app passwords. Rotate them once the shell is gone, so a still-live backdoor cannot read the new values.
  5. Federal and regulated teams. The KEV entry flags forensic triage as required and cites BOD 26-04. It says to discontinue use of the product if mitigations are unavailable. The due date is 26 October.

Sources

Keep reading

All latest →
  1. criticalExploitsPHP2Shell: Two Pre-Auth PHP RCEs Are Patched, but PAN-OS, Panorama and Cisco Expressway Still Wait9 min
  2. criticalExploitsPlex Media Server Exploit Chain Lands in CISA KEV: Patch to 1.43.3.10861 Now3 min
  3. highExploitsOracle's October CPU: Patch SOA Suite, Access Manager and EBS Mailer First3 min
  4. highExploitsSiteGuard Server Edition Command Injection Is Exploited, and Patching Can Wipe the Evidence3 min
  5. highExploitsRapid7 publishes five Zimbra flaws with public exploit scripts; two remain unpatched5 min
  6. highExploitsDirtyClone and snap-confine exploits land in Metasploit: any local shell becomes root on unpatched Linux and Ubuntu4 min