CVE-2026-110447

What is the Collabora Online Built-in CODE Server?

Nextcloud is a self-hosted file sync and collaboration platform, the open source alternative that organisations reach for when they want Google Drive or SharePoint without handing the files to someone else. Collabora Online is the office suite that renders and edits documents inside it. Most production deployments run Collabora as a separate service, in its own container or on its own host.

The Built-in CODE Server, shipped as the Nextcloud app richdocumentscode, is the shortcut past that. It bundles a complete Collabora Online Development Edition inside the Nextcloud application directory so that an administrator can enable document editing with one click and no second service to operate. That convenience is exactly why it is installed on a large number of small and medium Nextcloud instances, typically internet-facing, typically run by people without a dedicated operations team. It also means a bundled application server sits inside the web root of the file store, launched by PHP, running as the web server user, with the Nextcloud database credentials and every user's documents within reach.

Overview

CVE-2026-110447 is an unauthenticated OS command injection in proxy.php, the script the Built-in CODE Server app uses to start and reach its bundled Collabora instance. An HTTP request to that endpoint can cause an arbitrary operating system command to run as the web server user. No login, no user interaction, and no prior foothold are needed.

There is one precondition, and it is a weak one: the bundled CODE server must not currently be running. That is the state proxy.php is designed to handle, by launching the server on demand, and it occurs on every container restart, every upgrade, and every crash. An attacker who polls the endpoint simply waits for the window to open. Collabora scores the issue CVSS v4.0 9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N), where the AT:P metric is that restart condition. NVD had not published its own score at the time of writing, which is why this page shows no CVSS rating.

The order of events here is unusual and worth stating plainly. The fix shipped in richdocumentscode 26.4.303 on 2026-09-11, one day after the first attacks appear in operator access logs, but no CVE and no advisory accompanied it. Administrators spent three weeks finding web shells on their own servers and comparing notes on the Nextcloud forum before CVE-2026-110447 and GHSA-g3vx-3m76-fghh were published on 2026-10-14. CISA added the CVE to KEV on 2026-10-23 with a deadline of 2026-10-26.

Affected Versions

The critical caveat: disabling the app does not help. proxy.php is reachable directly through the web server regardless of whether Nextcloud has the app enabled, so the only safe states are an updated app or a deleted directory.

Technical Details

The CWE is CWE-78, improper neutralisation of special elements used in an OS command. In plain words, the program builds a shell command line out of text that came from the request and hands it to a shell, which reads parts of that text as instructions instead of as data.

The specific mistake is a layering error rather than missing escaping. When proxy.php finds the CODE server down, it builds a command to launch it, including a font configuration URL derived from the request host and path. Those values were passed through escapeshellarg, which is correct in isolation. The resulting command was then embedded in a bash -c string wrapped in double quotes, and inside double quotes a POSIX shell still performs command substitution, so $(...) in the supposedly escaped value is evaluated before the inner quoting ever matters. The fix in 26.4.303 applies escapeshellarg to the whole inner command rather than to its parts.

Observed payloads hit /apps/richdocumentscode/proxy.php?status with %2e%2e for path traversal, $(...) for the substitution, and ${IFS} in place of spaces to survive the surrounding quoting. The command typically base64-decodes a short script through sh, which writes a PHP file into the app directory and calls out to an external webhook to register the new shell. It is a single unauthenticated request, with no chaining to another CVE required.

Discovery

The reporter credited in GHSA-g3vx-3m76-fghh is wwwshellcodeit. The sequence that led there was driven by operators rather than by a formal disclosure: upstream issue 354 was opened on 2026-09-11 after administrators found unexplained PHP files, Collabora confirmed the fix on 2026-09-14 and advised deleting leftover shx*.php files on 2026-09-18, and users publicly asked for a CVE number on 2026-09-29. A Nextcloud forum warning on 2026-10-03 stated that exploitation was already underway while no CVE or vendor warning existed. The identifier followed on 2026-10-14. Note also that this is a different code path from CVE-2025-66208; that earlier fix does not prevent this one.

Exploitation Context

Exploitation is confirmed and began on or about 2026-09-10, based on access logs published by affected operators. The payload is a web shell dropped into apps/richdocumentscode/, reported under names matching shx*.php and shrf*.php, with shrf4645.php and Nx_33143.php named by individual victims. The latter was a one-line system($_GET[c]) backdoor, flagged by Nextcloud's own integrity check as an extra file. Post-exploitation activity described by victims and analysts includes searching the filesystem for credential stores and cryptocurrency wallets, and exfiltration attempts to webhook.site addresses.

No threat actor or group has been named, no ransomware use has been reported, and the activity reads as opportunistic mass scanning rather than targeted intrusion. No exposure count has been published by Shadowserver, Censys, or the vendors; the Nextcloud thread records hits across multiple independent operators, which is the only scale indicator available. The most important consequence for defenders is that updating does not evict an attacker: the dropped shells survive the patch, and a server that was running a vulnerable build while the CODE server was down at any point since early September should be treated as a possible compromise rather than simply as unpatched.

Remediation

1. Check the installed version with occ app:list or the Nextcloud apps page. Anything up to and including 26.4.302 is vulnerable.
2. Update richdocumentscode to 26.4.303 or later, ideally 26.4.402. Alternatively, remove the app entirely and confirm the apps/richdocumentscode directory is gone. Do not rely on disabling it; proxy.php is still served.
3. On Nextcloud 29 or earlier, upgrade Nextcloud itself or remove the app, since current builds of the app require Nextcloud 30.
4. Hunt for planted shells regardless of patch status: search the app directories for shx*.php, shrf*.php, and any PHP file you cannot account for, and delete what you find.
5. Run occ integrity:check-app richdocumentscode and occ integrity:check-core, which report extra files in the application tree, and review the results rather than dismissing them as noise.
6. Review web server access logs back to at least 2026-09-10 for requests to proxy.php containing %2e%2e, $(, %24%28, or ${IFS}, and for outbound calls to webhook.site.
7. If any evidence of compromise is found, rotate every secret the web server user could read: the Nextcloud database password, app passwords, OIDC or SMTP credentials, and any object storage keys. Consider restoring from a backup predating 2026-09-10.
8. Put the Nextcloud instance behind authentication at the reverse proxy where the deployment allows it, and consider running Collabora as a separate service instead of the bundled server.
9. Federal civilian agencies must remediate by 2026-10-26 under BOD 22-01.