CVE-2026-110447, Collabora Online Built-in CODE Server (Nextcloud richdocumentscode app): an unauthenticated command injection in proxy.php, exploited in the wild to plant PHP web shells, fixed in 26.4.303 (CVSS 4.0 9.2)
Exploited Nextcloud Collabora CODE app flaw: disabling the app does not help; update to 26.4.303 or remove it
Defender actions
- Update the Collabora Online Built-in CODE Server app (richdocumentscode) to 26.4.303 or remove it on every Nextcloud server that runs it; disabling the app does not stop the request, and on Nextcloud 29 or older, which is end of life, upgrade Nextcloud or remove the app.
- On each such server, search the web access logs back to at least early September 2026 for requests to apps/richdocumentscode/proxy.php that carry $( or an encoded .. in the path, and the app directory for PHP files that are not part of the release; on a hit, treat every secret the web server account can read as exposed and rotate it.
Analysis
Collabora's own advisory, published 2026-10-14, says users of Nextcloud with the Collabora Online Built-in CODE Server app (richdocumentscode) can be vulnerable through proxy.php: a request can run an operating system command as the web server user, the attack works only while the built-in CODE server is not running (after a restart, an upgrade or a crash), and disabling the app is not sufficient, it must be upgraded to 26.4.303 or later or removed (Collabora Online security advisory, 2026-10-14). Users of end-of-life Nextcloud 29 or older should upgrade Nextcloud or remove the app, standalone Collabora Online servers are not affected, and the fix for CVE-2025-66208 does not prevent this flaw (Collabora Online security advisory, 2026-10-14). The GitHub Advisory Database record for CVE-2026-110447 says it was exploited in the wild in September and October 2026 (GitHub Advisory Database, 2026-10-14). Field reports came first: on 2026-09-11 a hoster reported on the app's issue tracker that several Nextcloud servers running richdocumentscode 26.4.302 had been compromised since the previous day through requests to proxy.php that carried shell command substitution and an encoded path traversal, with base64 payloads decoded and run through a shell to create PHP web shells in the app directory; on one server the attacker then searched for password-manager databases and cryptocurrency-wallet files, and the reviewed requests showed no archiving or upload commands (issue 354, 2026-09-11). Other administrators report the same compromise, one noticing it because Nextcloud's integrity check failed on an unexpected PHP file (issue 354, 2026-09-11). A reply on the issue says the flaw affects only the Development Edition in the Built-in CODE Server mode that downloads a local AppImage, and a later one that leftover web-shell files must be removed after upgrading (issue 354, 2026-09-11). A Nextcloud forum post of 2026-10-03 told users to update, saying that as far as the poster knew no CVE existed (Nextcloud community forum, 2026-10-03).
Cited evidence
It is not sufficient to disable the app to avoid the problem, it must be upgraded to >= 26.4.303 or removed.
as exploited in the wild in September and October 2026
The attacker was able to create php-files which are web-shells:
This impacts only the Development Edition, and only in this (rather rarer) Built-in CODE Server deployment mode that downloads a local appimage.
Sources4
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.