Attackers have been exploiting a command-injection flaw in an optional Nextcloud app, “Collabora Online - Built-in CODE Server” (package richdocumentscode), to plant web shells on self-hosted Nextcloud servers. Three administrators reported break-ins on GitHub, with the first logged attack on September 10. Collabora fixed the bug in version 26.4.303 on September 11 and published an advisory with the identifier CVE-2026-110447 on October 14, saying it was exploited in the wild in September and October. How many servers were hit is not known.
The app’s proxy.php script starts a local document server when a request arrives and nothing is listening. In versions up to 26.4.302 it put text from the request path inside a double-quoted bash command, so a command written as $(...) ran as the web server user. The attack works only while the local server is down, such as during a restart, upgrade or crash. In the reported cases the shell then searched the server for password-manager databases and cryptocurrency wallet files; the administrators saw no commands that copied files out, and none of the reports show root access. A Collabora developer noted the flaw affects only this built-in deployment mode of the Development Edition, not standalone Collabora servers.
How to check if you’re affected
Affected products are Nextcloud servers running the Built-in CODE Server app, listed in the app list as “Collabora Online - Built-in CODE Server”, at any version before 26.4.303. Servers that use only the Nextcloud Office app with a separate Collabora server (Docker, Linux package or hosting provider) are not affected, per a warning posted on the Nextcloud community forum.
- Update the app to 26.4.303 or later, or remove it. Collabora’s advisory says disabling the app does not close the flaw. The fixed versions require Nextcloud 30 or later, so on Nextcloud 29 or older, upgrade Nextcloud or remove the app.
- Look for leftover
shx*.phpfiles (andshrf4645.php) inapps/richdocumentscode/and delete them. - Check access logs back to at least September 10 for
proxy.php?statusrequests whose path contains%2e%2e,$(or${IFS}, and forsudoattempts by the web server account. - Treat anything the web server account could read as potentially exposed and rotate it as appropriate.
Version 26.4.402 rewrote the start command, but administrators report it fails to start or open documents on some setups; the advisory names 26.4.303 as the fix. No newer release had appeared as of October 14. The Hacker News lists indicators from the administrators’ logs, including file names and attacker IP addresses.