CVE-2026-110447: Nextcloud's Collabora Built-in CODE Server Hit by Command Injection

Background

Collabora Online - Built-in CODE Server is a Nextcloud app (package richdocumentscode) that bundles a Collabora document-editing server so Nextcloud can edit documents without a separately deployed server. Collabora’s advisory is explicit about scope: standalone Collabora Online servers are not affected. Only the Nextcloud deployment that uses the built-in CODE server is.

Technical Mechanism

CISA and the GitHub advisory classify the flaw as CWE-78, OS command injection. The CVE record says it is in proxy.php and occurs when the CODE server is not running, for example after a restart. Collabora’s advisory (GHSA-g3vx-3m76-fghh) says a request can cause an operating system command to run as the web server user, with no authentication. The advisory’s title is “Unauthenticated OS command injection in the richdocumentscode proxy”.

The attack works only while the built-in CODE server is down. Collabora names a container restart, an upgrade or a crash as such moments. Disabling the app does not avoid the problem. It must be upgraded to 26.4.303 or later, or removed. A community post in the Nextcloud forum describes the cause as the way the app starts Collabora through a PHP exec. We treat that as a community explanation, not a vendor statement.

This is a different flaw from CVE-2025-66208. Collabora says the fix for that issue does not prevent this one.

Real-World Exploitation Evidence

The CVE record states the flaw was “exploited in the wild in September and October 2026”. CISA added it to the Known Exploited Vulnerabilities catalog on 23 October 2026 with a due date of 26 October 2026. The entry lists known ransomware campaign use as “Unknown”.

A fixed version predates the CVE. Collabora released richdocumentscode 26.4.303 on 11 September 2026 (GitHub release date), a month before the CVE and advisory were published on 14 October. The 26.4.303 release notes do not mention a security fix, and we did not confirm from the code diff that it contains the fix; we rely on the advisory’s statement that 26.4.303 is the patched version.

User reports (not vendor-confirmed) predate the CVE:

• On 11 September 2026 a hosting provider opened issue 354 on the richdocumentscode repository reporting “succesful hacks” (their spelling) on several Nextcloud servers since the previous day. The posted access-log lines show GET requests to apps/richdocumentscode/proxy.php?status with an encoded shell command embedded in the path, from 139[.]28[.]18[.]122. The issue reporter lists web shell files named shrf4645.php and shxa35d0.php. A second user in the issue reports shx13a86.php, found via Nextcloud’s integrity check, and a third user on 18 September says they were also victims. A commenter named mmeeks, whose Collabora affiliation we could not confirm, advises removing any lingering shx*.php files.
• On 3 October 2026 a Nextcloud forum user warned of an exploited shell command injection and said other users had found web shells on their servers.

After the CVE, on 16 October 2026, a forum user reported that Nextcloud’s integrity check flagged an extra file, Nx_33143.php, in the richdocumentscode app directory after updating. This is a single user report.

We found no named threat actor or campaign attached to the exploitation as of 26 October 2026 in the CVE record, the Collabora advisory or the CISA KEV entry. We could not open press coverage (BleepingComputer, The Hacker News) linked from the forum, so we do not rely on it.

Impact Assessment

Commands run as the web server user (per Collabora). In our assessment, from that position an attacker can typically read the Nextcloud configuration, which holds database credentials, and reach whatever files the web server can read, including user data in a default layout. User reports of dropped PHP web shells indicate attackers using the flaw to gain persistent access, not only run a one-off command.

A server is only exposed while the CODE server is stopped, but in our assessment restarts and crashes are routine, and the advisory says the window includes upgrades. Patching does not remove an existing web shell. Anyone who ran a vulnerable version should check for implants as well as update.

Affected Versions

Collabora also notes that users of end-of-life Nextcloud 29 and earlier should upgrade Nextcloud or remove the app. Release notes for 26.4.302 state “Require Nextcloud 30 or later”; the 26.4.303 notes are silent, so we infer the same requirement and have not confirmed it against the app listing.

The only published CVSS score is CVSS 4.0 base 9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N), from the CVE record’s MITRE CNA entry. NVD lists it as Secondary and the record was still “Undergoing Analysis” on 26 October 2026. Collabora’s GitHub advisory carries the same 9.2 score.

Remediation Steps

1. Update the richdocumentscode app to 26.4.303 or later, or remove the app. Disabling it is not enough.
2. If you run Nextcloud 29 or earlier, upgrade Nextcloud or remove the app.
3. Our suggestion: consider moving to a standalone Collabora Online server, which Collabora says is not affected.
4. If you ran a vulnerable version, assume possible compromise and check before trusting the server: look for unexpected PHP files, especially under apps/richdocumentscode/.
5. Run Nextcloud’s integrity check and investigate any extra files it reports.
6. Our advice: rotate secrets the web server user could read, including database credentials in config.php and app passwords, if you find signs of compromise.
7. Preserve logs before cleaning up. CISA’s KEV entry points to its forensic triage requirements under BOD 26-04.

Detection Guidance

• Search web server access logs for requests to apps/richdocumentscode/proxy.php, especially proxy.php?status, where the path contains shell syntax such as $(, ${IFS} or base64 strings. The user-reported log lines back to 10 September 2026 follow this pattern.
• Run occ integrity:check-app richdocumentscode or review the integrity report in the Nextcloud admin overview for EXTRA_FILE entries.
• Find unexpected .php files in the app directory, for example find apps/richdocumentscode -name '*.php' -newer <install date>, and compare with the release package.
• Look for outbound requests from the web server to unfamiliar hosts, since the reported payloads fetch content with curl or wget.
• Review access logs from 10 September 2026 onward, as the earliest user report dates from then.

We found no evidence of official indicators of compromise as of 26 October 2026 in the GHSA, the CVE record or issue 354 from Collabora. The patterns above come from user-posted logs and are not exhaustive.

Timeline

References

• Collabora advisory GHSA-g3vx-3m76-fghh
• GitHub advisory GHSA-f97p-r72q-64h2
• NIST NVD, CVE-2026-110447
• richdocumentscode issue 354, user security report
• richdocumentscode releases
• Nextcloud forum, To Collabora Built-in User: Update ASAP
• CISA, BOD 26-04 Prioritizing Security Updates Based on Risk