Collabora CODE flaw used to implant shells on Nextcloud servers
Attackers exploited a critical flaw in Collabora Online - Built-in CODE Server, an optional Nextcloud app, to install PHP web shells on Nextcloud servers. Collabora assigned the issue CVE-2026-110447, said it was exploited in the wild during September and October 2026, and released a fix in version 26.4.303 on September 11.
The affected package is richdocumentscode, which downloads and runs a local Collabora Online Development Edition (CODE) instance so that Nextcloud Office can edit documents without a separate Collabora server. Collabora’s advisory covers every release before 26.4.303. Standalone Collabora Online servers are not affected.
An injection path exposed during local server starts
The vulnerable proxy.php script starts the local CODE service when a request arrives and no local service is listening. In versions through 26.4.302, text supplied in the request, including the path, was inserted into a double-quoted Bash command. Shell command substitution expressed as $() could therefore be executed with the permissions of the web server account.
The condition limits exploitation to periods when the local document service is unavailable, such as a restart, upgrade or crash. It does not eliminate the risk: the script is a directly executed PHP file in the app folder and does not load Nextcloud code before it builds the command.
Collabora changed the command construction so that the start command is passed as a single escaped argument rather than a double-quoted string. The advisory is explicit that disabling the app does not close the exposure; administrators must upgrade to version 26.4.303 or later or remove the app. The corrected release requires Nextcloud 30 or newer. Systems on Nextcloud 29 or older, which are end of life, cannot install the fixed version and should upgrade Nextcloud or remove the app.
Reports show web shells and credential-store searches
The first administrator report described attacks against several servers running 26.4.302. Access logs recorded malicious requests on September 10 and 11 from a single IP address, targeting proxy.php?status with a shell command embedded in the request path. The command wrote a one-line PHP shell into the richdocumentscode directory and attempted to send system information to webhook.site.
On one affected server, the shell was then used to look for credential stores and cryptocurrency-wallet artefacts, including files such as *.kdbx, wallet.dat and keystore.json, as well as names associated with Bitwarden, 1Password and several wallet applications. The reviewed requests did not show archiving, uploading or copying files out, but data accessible to the web server account must be treated as potentially exposed.
Other administrators reported comparable activity. One found a new PHP file after Nextcloud’s integrity check flagged it, while another received emails about failed sudo attempts by the web server account. The reports did not show root-level compromise. A later attempt against a server updated to 26.4.303 did not create a new shell file.
Immediate checks for administrators
Administrators should update richdocumentscode to 26.4.303 or later, or remove it. They should search for shx*.php files, beginning in apps/richdocumentscode, and inspect access logs back to at least September 10 for proxy.php?status requests containing markers such as %2e%2e, $( or ${IFS}.
They should also investigate sudo attempts made by the web server account and review the exposure of information that account could read. For businesses using the built-in CODE deployment, patch status, file-integrity results and web logs should be treated as a single incident-review task rather than as separate maintenance checks.