--- schema: 1 kind: vulnerability title: "CVE-2026-110447, Collabora Online Built-in CODE Server (Nextcloud richdocumentscode app): an unauthenticated command injection in proxy.php, exploited in the wild to plant PHP web shells, fixed in 26.4.303 (CVSS 4.0 9.2)" headline: "Exploited Nextcloud Collabora CODE app flaw: disabling the app does not help; update to 26.4.303 or remove it" summary: > CVE-2026-110447 is an OS command injection in proxy.php of the Collabora Online Built-in CODE Server, the richdocumentscode app that runs Collabora inside Nextcloud; versions before 26.4.303 are affected, the GitHub advisory record says it was exploited in the wild in September and October 2026, and a hoster reported web shells on its Nextcloud servers on 2026-09-11. Disabling the app does not stop the request, so it must be updated to 26.4.303 or removed; standalone Collabora Online servers are not affected. discovered_at: "2026-10-15T03:42:00Z" updated_at: null event_date: "2026-10-14" run_id: 2026-10-15T0256Z-intel priority: high immediate_action: null tags: [vulnerabilities, actively-exploited, rce, pre-auth, zero-click, patch-available] regions: [global] sectors: [technology] entities: ["product:collabora-online-built-in-code-server"] techniques: [T1190, T1059.004, T1505.003, T1083] affected_products: ["Collabora Online Built-in CODE Server"] cves: - id: CVE-2026-110447 cvss: "9.2" epss: null type: rce vector: zero-click auth: pre-auth status: [exploited, patch-available] affected: "Collabora Online Built-in CODE Server (the richdocumentscode app for Nextcloud) before 26.4.303, exploitable while the built-in CODE server is not running (after a restart, an upgrade or a crash)" fixed: "26.4.303 or later; removing the app also closes it, disabling it does not; on Nextcloud 29 or older (end of life) upgrade Nextcloud or remove the app" sources: - url: "https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh" publisher: "Collabora Online security advisory" date: "2026-10-14" role: primary - url: "https://github.com/advisories/GHSA-f97p-r72q-64h2" publisher: "GitHub Advisory Database" date: "2026-10-14" role: corroborating - url: "https://github.com/CollaboraOnline/richdocumentscode/issues/354" publisher: "CollaboraOnline/richdocumentscode issue 354" date: "2026-09-11" role: primary - url: "https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516" publisher: "Nextcloud community forum" date: "2026-10-03" role: corroborating closed_sources: [] evidence: - quote: "It is not sufficient to disable the app to avoid the problem, it must be upgraded to >= 26.4.303 or removed." publisher: "Collabora Online security advisory" source_url: "https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh" - quote: "as exploited in the wild in September and October 2026" publisher: "GitHub Advisory Database" source_url: "https://github.com/advisories/GHSA-f97p-r72q-64h2" - quote: "The attacker was able to create php-files which are web-shells:" publisher: "CollaboraOnline/richdocumentscode issue 354" source_url: "https://github.com/CollaboraOnline/richdocumentscode/issues/354" - quote: "This impacts only the Development Edition, and only in this (rather rarer) Built-in CODE Server deployment mode that downloads a local appimage." publisher: "CollaboraOnline/richdocumentscode issue 354 (a reply on the issue)" source_url: "https://github.com/CollaboraOnline/richdocumentscode/issues/354" verification: multi-source sourcing_note: > The affected versions, the fix and the guidance that disabling is not enough come from Collabora's own advisory, the statement that the flaw was exploited in the wild from the GitHub advisory record (which also carries the CNA's CVSS 4.0 score of 9.2), and the first-hand exploitation account from administrators' reports on the app's issue tracker, the earliest dated 2026-09-11. No source names an actor, a victim organisation or a count of compromised servers. confidence: high references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 2 watchlist_hit: false actions: - "Update the Collabora Online Built-in CODE Server app (richdocumentscode) to 26.4.303 or remove it on every Nextcloud server that runs it; disabling the app does not stop the request, and on Nextcloud 29 or older, which is end of life, upgrade Nextcloud or remove the app." - "On each such server, search the web access logs back to at least early September 2026 for requests to apps/richdocumentscode/proxy.php that carry $( or an encoded .. in the path, and the app directory for PHP files that are not part of the release; on a hit, treat every secret the web server account can read as exposed and rotate it." updates: [] migrated_from: null --- Collabora's own advisory, published 2026-10-14, says users of Nextcloud with the Collabora Online Built-in CODE Server app (richdocumentscode) can be vulnerable through proxy.php: a request can run an operating system command as the web server user, the attack works only while the built-in CODE server is not running (after a restart, an upgrade or a crash), and disabling the app is not sufficient, it must be upgraded to 26.4.303 or later or removed ([Collabora Online security advisory, 2026-10-14](https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh)). Users of end-of-life Nextcloud 29 or older should upgrade Nextcloud or remove the app, standalone Collabora Online servers are not affected, and the fix for CVE-2025-66208 does not prevent this flaw ([Collabora Online security advisory, 2026-10-14](https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh)). The GitHub Advisory Database record for CVE-2026-110447 says it was exploited in the wild in September and October 2026 ([GitHub Advisory Database, 2026-10-14](https://github.com/advisories/GHSA-f97p-r72q-64h2)). Field reports came first: on 2026-09-11 a hoster reported on the app's issue tracker that several Nextcloud servers running richdocumentscode 26.4.302 had been compromised since the previous day through requests to proxy.php that carried shell command substitution and an encoded path traversal, with base64 payloads decoded and run through a shell to create PHP web shells in the app directory; on one server the attacker then searched for password-manager databases and cryptocurrency-wallet files, and the reviewed requests showed no archiving or upload commands ([issue 354, 2026-09-11](https://github.com/CollaboraOnline/richdocumentscode/issues/354)). Other administrators report the same compromise, one noticing it because Nextcloud's integrity check failed on an unexpected PHP file ([issue 354, 2026-09-11](https://github.com/CollaboraOnline/richdocumentscode/issues/354)). A reply on the issue says the flaw affects only the Development Edition in the Built-in CODE Server mode that downloads a local AppImage, and a later one that leftover web-shell files must be removed after upgrading ([issue 354, 2026-09-11](https://github.com/CollaboraOnline/richdocumentscode/issues/354)). A Nextcloud forum post of 2026-10-03 told users to update, saying that as far as the poster knew no CVE existed ([Nextcloud community forum, 2026-10-03](https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516)). **Exposure:** a Nextcloud server with the "Collabora Online - Built-in CODE Server" app at 26.4.302 or older, including one patched for CVE-2025-66208; a restart, an upgrade or a crash that stops the built-in CODE server opens the window, and deactivating the app does not close it ([Collabora Online security advisory, 2026-10-14](https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh)). **Detection:** in web access logs, requests to the app's proxy.php whose path carries `$(` command substitution and an encoded `..`; in file telemetry, unexpected PHP files in the app directory, which Nextcloud's integrity check flagged on a compromised server; in process telemetry, the web server account starting a shell that decodes base64 and calls out with curl or wget to an external service ([issue 354, 2026-09-11](https://github.com/CollaboraOnline/richdocumentscode/issues/354)). The web shell survives the update, so the post-patch check is the same file and process search, and the reporter says secrets available to the web server account must be treated as potentially affected ([issue 354, 2026-09-11](https://github.com/CollaboraOnline/richdocumentscode/issues/354)). **Defender takeaway:** update the app to 26.4.303 or remove it on every Nextcloud server that has it, because disabling it does not stop the request, and on Nextcloud 29 or older upgrade Nextcloud or remove the app ([Collabora Online security advisory, 2026-10-14](https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh)); then search for dropped PHP files and the request pattern back to at least early September 2026, and on a hit rotate whatever the web server account can read ([issue 354, 2026-09-11](https://github.com/CollaboraOnline/richdocumentscode/issues/354)).