Collabora CVE-2026-110447 Lets Attackers Backdoor Nextcloud

Collabora CVE-2026-110447 is an unauthenticated command injection in the Collabora Online Built-in CODE Server app (richdocumentscode) for Nextcloud, rated 9.2 under CVSS 4.0. Attackers used it from September 10, 2026 to drop PHP web shells on Nextcloud servers, about five weeks before the CVE was published on October 14. Version 26.4.303 fixes it. If you run the built-in app, upgrade or remove it today, then check for web shells, because the patch does not remove them.

What happened with Collabora CVE-2026-110447

The Built-in CODE Server app is a convenience package: it downloads a Collabora Online Development Edition AppImage and runs it on the Nextcloud host, so small installations get document editing without a separate Collabora server. A PHP script in the app, proxy.php, starts that local server when it is not already running. According to The Hacker News, versions up to 26.4.302 passed request data into the shell command used for that start without proper escaping, so a crafted request could run commands as the web server user.

The official CVE record describes it as OS command injection (CWE-78) in proxy.php that only works while the CODE server is not running, for example right after a restart, an upgrade or a crash. The record states the flaw was "exploited in the wild in September and October 2026."

Administrators saw it first. GitHub issue #354 on the richdocumentscode repository, opened September 11, documents requests to /apps/richdocumentscode/proxy.php?status on September 10 and 11, followed by new PHP files in the app folder. Collabora released 26.4.303 on September 11. A Nextcloud community forum post on October 3 told built-in users to update because the flaw was already being exploited. The CVE and the GitHub advisory (GHSA-g3vx-3m76-fghh) followed on October 14.

Who is affected

Only one deployment model is vulnerable:

Affected: Nextcloud servers with the "Collabora Online - Built-in CODE Server" app (richdocumentscode) at any version before 26.4.303.
Not affected: standalone Collabora Online servers, Collabora run from Docker or RPM/DEB packages, Collabora hosting services, Nextcloud All-in-One, and Nextcloud Office (richdocuments) installs that point at a separate Collabora server.

Two details catch people out. First, Collabora's advisory says disabling the app is not enough: it must be upgraded to 26.4.303 or later, or removed. WZ-IT reports that requests to proxy.php were still processed on servers where the app was disabled, because the file stays in apps/richdocumentscode. Second, The Hacker News reports that fixed versions require Nextcloud 30 or later, while the app store still serves an affected version to Nextcloud 29 and older, which are end of life. On those servers the only fix is upgrading Nextcloud or removing the app.

Nextcloud told BleepingComputer it had not seen widespread exploitation. Nobody has published a count of compromised servers. Some forum users said ransomware operators were involved, which BleepingComputer could not confirm.

What the attackers did

The reports in issue #354 and the Nextcloud forum describe a consistent pattern:

Web shells. Files named shx*.php (for example shx13a86.php and shxa35d0.php) and shrf4645.php appeared in apps/richdocumentscode/. A forum user found a different one, Nx_33143.php, on October 16 through the Nextcloud integrity check, so do not hunt by the shx prefix alone.
Callbacks. The payloads tried to send system details to a webhook.site address. Issue #354 lists source addresses 139.28.18.122 (September 10 and 11) and 89.38.98.50 (September 14).
Credential hunting. On one server the attacker used the shell to search for KeePass databases (*.kdbx), wallet.dat and keystore.json files. The reviewed requests did not show exfiltration commands, but the reporter's advice stands: treat anything the web server account could read as exposed.

No report shows the attackers gaining root. The web server account is still enough to read config.php (database credentials and secrets) and, on most installs, the data directory. Our explainer on what a web shell is and how one gets onto a server covers why these small files are so durable.

What to do now

Find out whether the app is installed. Run occ app:list as the web server user and look for richdocumentscode and its version. If it is absent, you are not affected by this CVE.
Upgrade or remove. Move to 26.4.303 or later through the app store, or uninstall the app and confirm the apps/richdocumentscode directory is gone. Do not rely on disabling it. Some administrators reported that 26.4.402 (September 24) stopped the CODE server from starting and rolled back to 26.4.303, which is still a fixed version.
Check for web shells. Run occ integrity:check-app richdocumentscode and investigate every extra file it reports. Then look for any unexpected .php file in the app directories, not just shx*.php. Our step-by-step guide on how to check for Nextcloud web shells walks through the full sequence.
Search the access logs back to September 10. Look for proxy.php?status requests that contain encoded path sequences (%2e%2e), shell syntax ($(, %24%28 or ${IFS}) or base64, and for repeated ?c= requests to PHP files in the app folder. Logs that rotated out before September 10 cannot clear a server.
If you find a shell, rotate. Change the database password and the secrets in config.php, app passwords, and any credential stored where the web server user could read it. The reason that scope is so wide is covered in why your web server account should not read your secrets.
Decide whether to rebuild. A shell that ran arbitrary commands may have left more than one file. If you cannot account for everything the account touched, rebuild from a known-good backup, as we argued in why you rebuild before you rotate credentials.

Why the fix took five weeks to surface

The Hacker News reports the fix was four lines in proxy.php, written on August 20 and committed on September 9 under a non-security title. The 26.4.303 release notes mentioned only the bundled CODE build. A Collabora maintainer blamed the delay on a "record backlog" in GitHub's advisory database. BleepingComputer cites Second Security research putting the median gap between a public fix and its CVE at 39 days in August 2026, up from 5.1 days in January.

For defenders that gap is the real lesson. Anyone watching the repository or GitHub issue #354 knew about the attacks in mid-September. Teams that wait for a CVE or a scanner signature were exposed for a month with no alert.

What to watch next

CISA KEV. CVE-2026-110447 was not in the KEV catalog as of the October 16, 2026 release, despite confirmed exploitation. An addition would set a federal deadline.
More shell names. The Nx_33143.php report suggests more than one actor or toolkit. Expect new file names in the forum thread.
Nextcloud 29 and older. Watch for a backported fix. Until then, removal is the only option on those versions.
Related history. Self-hosted file sharing stays a target: CISA added the ownCloud graphapi flaw CVE-2023-49105 to KEV in August after data theft.