Collabora CODE RCE hits Nextcloud: CVE-2026-110447 exploited

CVE-2026-110447 is an unauthenticated OS command injection in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud, scored CVSS v4 9.2. It has been exploited in the wild since mid-September to drop PHP webshells. If you run Nextcloud Office with the bundled CODE server, update now — disabling the app is not enough.

The exploitation was first surfaced in richdocumentscode GitHub issue #354 by administrators who found webshells on their servers; the vendor advisory GHSA-g3vx-3m76-fghh landed October 14, and BleepingComputer reported it. This is a distinct issue from CVE-2025-66208.

What the bug does

The flaw is in proxy.php, the script that starts the CODE server when it is not already listening. Up to version 26.4.302, text from the request — including the path — was placed into a double-quoted Bash command, so a $(...) substitution runs in the shell with the web server account's privileges. No authentication or user interaction is required. The window opens whenever the bundled CODE server is not running: after a container restart, an upgrade, or a crash.

Crucially, proxy.php is served directly by the web server without loading Nextcloud's code, so turning the app off does not block access to it.

Affected versions

• richdocumentscode before 26.4.303 — all releases up to and including 26.4.302.
• Fixed in 26.4.303, released September 11 (shipped without a security note at the time).
• Not affected: standalone Collabora Online servers (Docker, RPM/DEB packages, Nextcloud All-in-One) and Nextcloud Office installs without the built-in app.

Exploitation status

Confirmed. The first logged requests to proxy.php?status were on September 10. Attackers wrote a one-line PHP webshell into the app folder, then sent the output of uname -a to a webhook.site address; on at least one server the operator searched for password-vault and cryptocurrency-wallet files. Nextcloud says it has not observed widespread exploitation. No root access has been reported, and no actor is named.

What to do today

1. Update richdocumentscode to 26.4.303 or later, or remove the app. Disabling it is insufficient.
2. Hunt for webshells named shx*.php, starting under apps/richdocumentscode.
3. Grep web-server logs since September 10 for requests to proxy.php?status containing %2e%2e, $(, or ${IFS}. Reported attacker IPs: 139.28.18.122 and 89.38.98.50.
4. If you find a hit, assume compromise: rotate any credentials and wallet material the web-server account could reach.

Context

Watch the upgrade path: version 26.4.402 (September 24) breaks the CODE server on some PHP-FPM setups where open_basedir does not permit /dev/null, and some administrators have rolled back to 26.4.303. The pattern here is the familiar one for bundled helper services — a fix shipped quietly in a routine release weeks before the advisory, leaving a gap in which attackers reading the commit history moved first.