Nextcloud Collabora CODE RCE CVE-2026-110447 exploited

CVE-2026-110447 is an unauthenticated OS command injection in the Collabora Online – Built-in CODE Server Nextcloud app (package richdocumentscode), and it has been exploited in the wild since September. The flaw lives in proxy.php: request-path text is placed inside a double-quoted bash command, so a $(...) substitution in the path executes as the web-server user. The authoritative write-up is in the CollaboraOnline/online security advisories; the fix landed in 26.4.303, released September 11, 2026.

What's affected

• All richdocumentscode versions before 26.4.303 (up to and including 26.4.302).
• The exploit path only fires when the app's local document server is not running — during a restart, upgrade, or crash. That is a narrower window than "always on," but a predictable one, and attackers are spraying for it.
• Not affected: standalone Collabora Online servers, and installs that use only the Nextcloud Office app (richdocuments) without the built-in CODE server.
• Fixed builds require Nextcloud 30 or later. Nextcloud 29 and older are end-of-life and cannot install 26.4.303.

This is a distinct bug from CVE-2025-66208, an earlier command injection in the same proxy.php fixed in 25.04.702. The 26.4.303 fix does not cover CVE-2025-66208, and vice versa — patch for both.

Exploitation status

The CVE record states exploitation in September and October 2026, with the first logged attack on September 10. Attackers used it to plant PHP web shells; follow-on activity reported by defenders includes credential and crypto-wallet discovery from the compromised hosts. The number of affected servers is unknown. The issue was reported by three Nextcloud administrators on GitHub, and the advisory credits reporter wwwshellcodeit.

Note the awkward patch timeline: the four-line proxy.php fix shipped in 26.4.303 without a security notice, so operators who upgrade on security-advisory cadence may have missed it. Disabling the app does not close the flaw — you must upgrade.

Action checklist

1. Upgrade richdocumentscode to 26.4.303 or later now. If you are on Nextcloud 29 or older, you cannot install the fix — plan the Nextcloud 30 upgrade as an incident, not a roadmap item.
2. Do not rely on disabling the app. The advisory is explicit that disabling it leaves the flaw reachable.
3. Hunt for web shells under apps/richdocumentscode/ — unexpected .php files there are presumed compromise. Any server exposed before 26.4.303 should be treated as potentially backdoored.
4. Search access logs for requests to /apps/richdocumentscode/proxy.php carrying path-traversal and shell-substitution markers (%2e%2e, $(, ${IFS}, base64 -d piped to a shell). The vendor and community reporting published a full IOC set, including file names, a SHA-256, and source IPs — pull those verbatim from the source rather than a summary.
5. If you find a shell, rotate any credentials reachable from the host and review for crypto-wallet and secret exfiltration, matching the observed post-exploitation behavior.
6. Watch 26.4.402 (September 24) — it has reported startup and document-opening problems, and some administrators reverted to 26.4.303. 26.4.303 is the safe floor.

Context

A document-collaboration add-on is exactly the kind of component that slips a patch cadence: it is bundled, it auto-updates on a different schedule than the core platform, and a four-line fix with no CVE attached draws no attention until the web shells show up. The restart-window trigger makes the timing worse — every maintenance reboot is a fresh exploitation opportunity until the box is patched. Treat any internet-reachable Nextcloud running the built-in CODE server before September 11 as a hunt target, not just a patch target.