Collabora — Remote Code Execution in Nextcloud’s Built-in CODE Server (CVE-2026-110447)

Publication date: October 14, 2026
Category: Vulnerability / Malware

Introduction

Throughout September and October 2026, system administrators and incident response teams identified an active exploitation campaign targeting Nextcloud servers. Threat actors successfully deployed web shells by exploiting a critical OS command injection vulnerability within the optional Collabora Online - Built-in CODE Server application (richdocumentscode). Tracked officially as CVE-2026-110447, the flaw allows unauthenticated attackers to execute arbitrary code under the web server user privileges during specific restart or service crash conditions.

What is CVE-2026-110447? (General Analysis)

The richdocumentscode app downloads and executes a bundled copy of the Collabora Online Development Edition (CODE) directly inside the Nextcloud server instance, enabling document editing without requiring an independent external Collabora server. This deployment mode is targeted primarily at local testing, personal use, or small team environments.

The security flaw resides within the proxy.php control script, which initializes the local CODE server whenever incoming requests arrive and no listening process is detected. In vulnerable versions, the script constructed Bash commands utilizing double-quoted strings that unsafely incorporated HTTP request parameters (including the request path), thereby permitting shell command interpolation via operators such as $(...).

  • Official CVE: CVE-2026-110447 (Verified in NVD)
  • CVSS Score and Severity: 9.2 CRITICAL (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
  • CWE Classification: CWE-78 (Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’))
  • CISA KEV Catalog: Not reported

(Supplementary note: Last December, a related issue was disclosed under identifier CVE-2025-66208, a configuration-dependent command injection vulnerability in the same script scoring 7.2 HIGH on CVSS v4.0 with CWE-78, which did not mitigate the current vector).

How Does It Work? (Technical Analysis)

The exploitation mechanism relies on specific lifecycle characteristics of the integrated CODE server and design flaws in raw PHP shell argument handling.

  • Infection Flow and Exploit Entry: The proxy.php script executes directly from the app folder without loading the Nextcloud core framework. Because unsafe concatenation processed the HTTP request path, attackers could dispatch crafted requests to /apps/richdocumentscode/proxy.php?status embedding traversal patterns and shell sequences inside the path itself (such as %2e%2e, $(), or ${IFS}).
  • Race Condition / Execution Window: The flaw is triggered exclusively when the local CODE server is inactive—for example, immediately following a container restart, software upgrade, or application crash. If the service is already running, incoming requests bypass the vulnerable startup logic.
  • Persistence and Exfiltration: Once code execution was achieved under the web server user account (e.g., www-data), attackers decoded single-line PHP web shells (such as shx*.php) into the app directory. Observed payloads executed system reconnaissance (uname -a), forwarded outputs to external webhooks, and targeted credential stores and cryptocurrency wallets (files matching *.kdbx, wallet.dat, keystore.json, alongside identifiers for Bitwarden, 1Password, Bitcoin, Electrum, Monero, and Ethereum).

Affected Systems / Environments

The vulnerability impacts exclusively specialized deployments utilizing the integrated development application.

CVE Category (CWE) Impact CVSS Vector (summary)
CVE-2026-110447 CWE-78 RCE / Web shell 9.2 (Critical) AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H
CVE-2025-66208 CWE-78 RCE / Config-dependent 7.2 (High) AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H
  • Affected Software: Collabora Online - Built-in CODE Server (richdocumentscode) in versions prior to 26.4.303.
  • Secure Environments: Standalone Collabora Online servers are unaffected. Deployments utilizing solely the standard Nextcloud Office app (richdocuments, without the built-in server package) are safe, regardless of whether Collabora runs via Docker, Linux packages, or external hosting providers.
  • Platform Requirement: Fixed versions require Nextcloud 30 or later. Nextcloud 29 and older are End-of-Life.

Mitigation and Detection

Remediation

  1. Priority Update: Update richdocumentscode (Collabora Online - Built-in CODE Server) to version 26.4.303 or later.
  2. Removal for Unsupported Instances: Disabling the app within Nextcloud does not remediate the flaw; if running legacy Nextcloud versions (<= 29) unable to support the patched branch, administrators must completely remove/uninstall the application from the server.
  3. Artifact Cleanup: Following updates, audit the filesystem for leftover suspicious PHP files (matching shx*.php) inside the apps/richdocumentscode directory.

Detection

Defensive teams should conduct retrospective log analysis across web access logs dating back to at least September 10, 2026, searching for specific Indicators of Compromise (IoCs):

SOC Analyst Note: Any file or resource readable by the web server user account must be treated as potentially compromised following such an intrusion, mandating a comprehensive rotation of stored credentials and secrets.

  • HTTP Request Patterns: Inbound requests targeting proxy.php?status whose request path contains strings like %2e%2e, $(), ${IFS}, or base64 -d piped into sh.
  • Reported Malicious File Names:
    • shrf4645.php, shxa35d0.php, shx5cf91.php, shxd33ce.php, shxf4645.php, shx13a86.php, shx56367.php (located within apps/richdocumentscode/).
  • Known Web Shell SHA-256 Hash:
    • 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562
  • Observed Attacker IP Addresses:
    • 139.28[.]18[.]122
    • 89.38[.]98[.]50
  • Telemetry Exfiltration Domains:
    • webhook[.]site (associated with callback IDs 45060ed4-de0b-4119-8f0d-2a2776bbd413 and 774cf5e1-b5a4-4174-a1ad-0241861029a2).

Wrapping Up

Active exploitation of CVE-2026-110447 demonstrates how optional, rapid-deployment built-in components in collaboration software can introduce critical entry vectors when process initialization handles command shell interpolation insecurely. Coordinated response efforts required specific software patches, underscoring that administrators must rely on thorough updates and component removal rather than simple service disabling when securing production environments.

References