Critical flaw in Collabora's Built-in CODE plants web shells on Nextcloud servers

Attackers exploited a flaw in an optional Nextcloud app — Collabora Online — Built-in CODE Server — to plant web shells on servers. Three administrators reported it on GitHub, with the first logged attack on September 10. A web shell is a small file that runs any command sent over an HTTP request, with the rights of the web server account.

The flaw is tracked as CVE-2026-110447 and its record calls it "exploited in the wild in September and October 2026." Collabora fixed it on September 11 in version 26.4.303 and published an advisory on October 14. Crucially, disabling the app is not enough — it must be updated (to 26.4.303 or later) or removed.

Who is affected

The app (package richdocumentscode) downloads a copy of Collabora Online Development Edition and runs it on the Nextcloud server itself, so documents can be edited without a separate Collabora server. Its store listing marks it for local testing and non-production use, for personal use or small teams. Standalone Collabora Online servers are not affected, nor are installations using only the Nextcloud Office app (richdocuments) without the built-in CODE.

How it works

The proxy.php script starts the local CODE server when a request arrives and nothing is listening. In versions up to 26.4.302, text from the request, including its path, was placed inside a double-quoted bash command, where the shell still runs anything written as $(...). A request with a command hidden in its path executed it as the web server user. The attack only works while the server is down — during a container restart, an upgrade, or a crash.

What the attackers did

One administrator found his servers compromised; logs from two of them showed requests to proxy.php?status from a single IP. The command decoded a one-line PHP web shell into the app's folder and tried to send uname -a output to a webhook.site address. On one server the attacker hunted for credential stores and crypto wallets: *.kdbx, wallet.dat, keystore.json files and traces of bitwarden, 1password, Bitcoin, Electrum, Monero and Ethereum. No file exfiltration was seen, but anything the web server account can read should be treated as potentially exposed. In no case did the attacker gain root.

A fix that shipped without a security notice

The change that closed the flaw is just four lines: the launch command is now handed to bash as a single escaped argument. Caolán McNamara wrote the commit on August 20, yet it missed version 26.4.302 (August 31) and was only committed on September 9 — a day before the first attack. Forum members warned of active exploitation on October 3, while no CVE existed; the official advisory arrived only on October 14.

Owners of Nextcloud 29 and older, where 26.4.303 cannot be installed, should upgrade Nextcloud or remove the app. After updating, look for and delete any leftover shx*.php files.

Source: The Hacker News