Attackers have been exploiting a critical command-injection flaw in the Collabora Online Built-in CODE Server, an optional app for Nextcloud, to plant web shells on self-hosted servers. CISA added the flaw, tracked as CVE-2026-110447, to its Known Exploited Vulnerabilities catalog on October 23. Disabling the app does not close the hole: administrators must update or remove it.
What happened
The bug sits in proxy.php inside the richdocumentscode app. According to The Hacker News, the script placed request text inside a double-quoted bash command, so shell syntax such as $(…) in a request path ran as the web server user. It can be triggered without authentication, but only while the app’s local document server is down, for example during a restart, upgrade or crash.
The first logged attack was on September 10, 2026. A fix, version 26.4.303, shipped on September 11, and Collabora’s advisory followed on October 14. Reporting from The Hacker News and eSecurity Planet says attackers dropped PHP web shells into the app directory, sent system information to a webhook.site address, and on at least one server searched for password-manager files and cryptocurrency wallets. Reviewed reports did not show root access, and theft of sensitive files has not been established.
Who is affected
Nextcloud installations running richdocumentscode earlier than 26.4.303 are vulnerable. Standalone Collabora Online servers, and setups that use only the Nextcloud Office app without the built-in server, are not affected. The fix requires Nextcloud 30 or later, and Nextcloud 29 and older are end of life. Federal civilian agencies were told to apply fixes by October 26.
What to do
- Update richdocumentscode to 26.4.303 or later, or remove the app entirely. Disabling it is not enough.
- If you run Nextcloud 29 or older, upgrade Nextcloud or remove the app.
- Look for PHP files named shx*.php (for example shrf4645.php) under apps/richdocumentscode/, and review access logs back to at least September 10 for proxy.php?status requests containing $( or ${IFS}.
- If you find a shell, treat anything the web server account could read as exposed, rotate those credentials, preserve logs, and consider rebuilding the server. Patching alone does not remove existing attacker access.
Our analysis: version 26.4.402, released September 24, is reported to fail on some setups, and some administrators have reverted to 26.4.303. Test any upgrade, but do not leave the vulnerable build running while you do.
What we still do not know
The number of compromised servers has not been disclosed, and no attacker has been publicly identified. The reports point to two source IP addresses, but attribution is not established. CVSS scores differ between outlets: The Hacker News reported 9.2 for the CISA listing, while eSecurity Planet gave no score. Exact data theft, if any, is unconfirmed. Administrators first warned of exploitation on a Nextcloud forum on October 3, so servers that were exposed before patching may have been compromised well before the CVE was published.
Sources: The Hacker News, Oct. 14, 2026; eSecurity Planet, Oct. 20, 2026; The Hacker News on the CISA KEV listing, Oct. 24, 2026.
Leave a Reply