CVE-2026-110447Collabora Online Built-in CODE Server (richdocumentscode) OS command injection in proxy.php

Executive summary

CVE-2026-110447 is an unauthenticated OS command injection (CWE-78) in proxy.php of the Nextcloud app "Collabora Online - Built-in CODE Server" (richdocumentscode). Request data was placed into a bash command, so a crafted request runs commands as the web server user. The flaw is only reachable while the bundled CODE server is not running, for example after a restart, upgrade or crash. Collabora rates it CVSS 4.0 9.2 (Critical).

Exploitation started around 2026-09-10, roughly a month before the CVE and GitHub advisory were published on 2026-10-14. Administrators reported PHP web shells (shx*.php) written into apps/richdocumentscode/ and follow-up searches for password databases and cryptocurrency wallets. CISA added the CVE to KEV on 2026-10-23.

The fix is richdocumentscode 26.4.303 (released 2026-09-11), which requires Nextcloud 30 or later. Disabling the app does not remove the risk: it must be upgraded or removed. Standalone Collabora Online servers, Docker and package installs, and Nextcloud Office (richdocuments) without the built-in app are not affected. Every self-hosted Nextcloud should be checked explicitly for this app, as the CVE name suggests a wider Collabora issue than actually exists.

Threat assessment

Risk is critical for any internet-facing Nextcloud with richdocumentscode below 26.4.303: no authentication or user interaction is needed, and the precondition (CODE server not running) occurs naturally after restarts and updates. Successful exploitation yields code execution as the web server account, which typically can read config.php (database credentials, secrets) and user data.

Exploitation was observed in the wild from 2026-09-10 (GitHub issue #354, The Hacker News). BleepingComputer notes unconfirmed user claims of ransomware involvement; no threat actor is named by any source reviewed. Nextcloud 29 and older (EOL) cannot receive the fixed app version and stay exposed unless Nextcloud is upgraded or the app is removed. Servers that were vulnerable and restarted after 2026-09-10 should be treated as potentially compromised even if now patched.

Timeline

1. 2026-10-26

   CISA KEV remediation due date; Nextcloud forum update notes the KEV listing and that some installations remain unpatched. Source

2. 2026-10-23

   CISA adds CVE-2026-110447 to the KEV catalog (forensic triage required). Source

3. 2026-10-15

   BleepingComputer reports web shell backdoors on Nextcloud servers; unconfirmed user claims of ransomware involvement. Source

4. 2026-10-14

   Collabora publishes GHSA-g3vx-3m76-fghh and CVE-2026-110447 (CVSS 4.0 9.2), naming 26.4.303 as the fixed version. Source

5. 2026-10-03

   Nextcloud community forum warning urges Built-in CODE users to update due to active exploitation. Source

6. 2026-09-14

   Exploitation attempt from a second IP against an already patched server; no new file created. Source

7. 2026-09-11

   richdocumentscode 26.4.303 with the fix is released; a second logged attack occurs the same day. Source

8. 2026-09-10

   First logged in-the-wild attack: web shells written into apps/richdocumentscode/. Source

9. 2026-09-09

   Fix committed to the richdocumentscode repository. Source

Affected & exposure

Nextcloud app richdocumentscode (Collabora Online - Built-in CODE Server): all versions before 26.4.303 (vulnerable reports confirmed on 26.4.302).

Fixed: richdocumentscode 26.4.303 and later (requires Nextcloud 30+). Nextcloud 29 and older (EOL) must upgrade Nextcloud or remove the app.

Not affected per Collabora/Nextcloud: standalone Collabora Online servers, Collabora/CODE run via Docker or RPM/DEB packages, Nextcloud All-in-One, and the Nextcloud Office app (richdocuments) used without richdocumentscode.

Distinct from CVE-2025-66208: the fix for that issue does not prevent CVE-2026-110447.

Exploitation in the wild

Exploited in the wild in September and October 2026 per the CVE record; CISA KEV since 2026-10-23 (ransomware use: Unknown).

Attack vector: unauthenticated HTTP requests to /apps/richdocumentscode/proxy.php (logged as proxy.php?status) while the CODE server is stopped. Reported request markers include %2e%2e path traversal, $(...) command substitution, ${IFS} and base64-decoded payloads piped to sh (GitHub issue #354, The Hacker News).

Post-exploitation: one-line PHP web shells named shx*.php or shrf*.php written to apps/richdocumentscode/, verified with repeated ?c=id requests; host information sent to webhook.site callbacks; searches for *.kdbx, wallet.dat, keystore.json and wallet directories (GitHub issue #354).

Published IOCs (GitHub issue #354, The Hacker News): source IPs 139.28.18.122 (2026-09-10/11) and 89.38.98.50 (2026-09-14 attempt); web shell SHA-256 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562; file names shxa35d0.php, shx5cf91.php, shxd33ce.php, shxf4645.php, shx13a86.php, shx56367.php, shrf4645.php.

Nextcloud forum reports a further web shell Nx_33143.php in apps/richdocumentscode/ detected by the Nextcloud integrity check, and sudo failure emails as an early sign of compromise.

After upgrading, one admin observed coolwsd processes started with a malicious remote_font_config.url carrying the injected payload (GitHub issue #354).

Detection & hunting

Hunt in web server access logs back to at least 2026-09-10 for requests to the richdocumentscode proxy carrying shell metacharacters, for any access to new PHP files in the app directory, and on the host for shell processes spawned by the web server account. Run the Nextcloud integrity check (occ integrity:check-app richdocumentscode) to find unexpected files.

index=web (sourcetype=access_combined OR sourcetype=nginx:plus:access OR sourcetype=apache:access) uri="*/apps/richdocumentscode/proxy.php*"
| eval u=urldecode(uri)
| where match(u, "\$\(|\$\{IFS\}|base64|\.\./") OR like(uri, "%2e%2e%")
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as status values(useragent) as ua by src_ip, host
| convert ctime(first_seen) ctime(last_seen)

title: Possible Web Shell Access in Nextcloud richdocumentscode App (CVE-2026-110447)
status: experimental
description: Detects HTTP requests to PHP files other than the expected proxy.php in apps/richdocumentscode, matching web shell names reported for CVE-2026-110447 exploitation.
references:
  - https://github.com/CollaboraOnline/richdocumentscode/issues/354
logsource:
  category: webserver
detection:
  selection_dir:
    cs-uri-stem|contains: '/apps/richdocumentscode/'
  selection_php:
    cs-uri-stem|endswith: '.php'
  filter_proxy:
    cs-uri-stem|endswith: '/apps/richdocumentscode/proxy.php'
  selection_names:
    cs-uri-stem|contains:
      - '/shx'
      - '/shrf'
      - '/Nx_'
  condition: (selection_dir and selection_php and not filter_proxy) or (selection_dir and selection_names)
falsepositives:
  - Unlikely; the app normally only serves proxy.php over HTTP
level: high

DeviceProcessEvents
| where Timestamp > datetime(2026-09-10)
| where AccountName in~ ("www-data", "apache", "nginx", "http", "wwwrun")
| where FileName in~ ("sh", "bash", "dash", "base64", "curl", "wget", "sudo", "find")
| where InitiatingProcessFileName in~ ("php", "php-fpm", "apache2", "httpd", "sh", "bash") or ProcessCommandLine has "richdocumentscode"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp asc

DeviceProcessEvents
| where FileName has "coolwsd" or ProcessCommandLine has "coolwsd"
| where ProcessCommandLine has "remote_font_config" and (ProcessCommandLine has "$(" or ProcessCommandLine has "base64" or ProcessCommandLine has "IFS")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine

Mitigation

• Upgrade richdocumentscode to 26.4.303 or later immediately (requires Nextcloud 30+), or remove the app. Disabling the app is not sufficient.
• On Nextcloud 29 or older (EOL): upgrade Nextcloud to a supported release or remove richdocumentscode; the app store does not offer a fixed version there.
• If the app is only used for convenience, consider moving to a standalone Collabora Online/CODE server (Docker or package), which is not affected.
• Run occ integrity:check-app richdocumentscode and remove unexpected PHP files (shx*.php, shrf*.php, Nx_*.php); check for coolwsd processes with unusual remote_font_config.url arguments and restart them after cleanup.
• Review access logs back to at least 2026-09-10 for proxy.php?status requests with shell metacharacters and for sudo attempts by the web server user.
• If compromise is suspected: treat everything readable by the web server account as exposed, rotate database credentials, Nextcloud secrets and app passwords, and consider rebuilding the host rather than cleaning it.
• Federal agencies under BOD 26-04: KEV due date 2026-10-26 and forensic triage is marked as required in the KEV entry.

Update log

Sources

1. GitHub Security Advisory GHSA-g3vx-3m76-fghh: Unauthenticated OS command injection in the richdocumentscode proxy
2. CVE record CVE-2026-110447 (CVE List V5)
3. CISA Known Exploited Vulnerabilities catalog (JSON)
4. Nextcloud community forum: To Collabora Built-in user: update ASAP
5. richdocumentscode issue #354: Security issue - Hack
6. The Hacker News: Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora's Built-in CODE App
7. BleepingComputer: Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers