Collabora CODE CVE-2026-110447: Patch Nextcloud, Then Hunt

If your Nextcloud server runs the Collabora Online - Built-in CODE Server app (richdocumentscode) at any version before 26.4.303, treat it as exposed to unauthenticated remote code execution. Update the app to the current release or remove it today, then hunt for web shells: the fix shipped on September 11, 2026, attacks were reported from September 10, and the CVE was not published until October 14. CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities (KEV) catalog on October 23, with a due date of October 26 for US federal civilian agencies.

Are you affected?

The CVE record is specific: the flaw is “not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.”

The two app names are easy to confuse. richdocuments is the Nextcloud Office connector. richdocumentscode is the optional app that bundles a CODE (Collabora Online Development Edition) AppImage and starts it on the Nextcloud host. Only the second is in scope.

Check which you have from the Nextcloud directory:

# Run as the web server user; adjust the user and path for your install
sudo -u www-data php occ app:list | grep -E 'richdocuments(code)?:'

The vulnerability

The AT:P (attack requirements present) in the vector reflects that precondition: the bundled server has to be down. That is less of a barrier than it sounds. Restarts, app upgrades and crashes all stop it, and in the vulnerable code an unauthenticated ?status request to proxy.php is what asks for the server to be started when it is not running. If you are new to v4.0 vectors, our guide to reading a CVSS v4.0 vector string walks through each metric.

The CVE record also says this is “a different vulnerability than CVE-2025-66208”, so a host patched for that earlier issue is not covered.

What the fix changed

The CVE record describes the bug only as command injection in proxy.php. The app’s public repository shows more. This section is our reading of that source, not a vendor statement.

In 26.4.302, startCoolwsd() built the launch command as one string. Two values derived from the request, the HTTP Host header and the request URI (used to build a font-configuration URL), were each passed through PHP’s escapeshellarg(), which wraps them in single quotes. The whole command was then placed inside a double-quoted bash -c "..." string and handed to the shell. Single quotes have no special meaning inside double quotes, so shell command substitution in those values was still evaluated by the outer shell.

The 26.4.303 change, committed on September 9, wraps the entire inner command in escapeshellarg() before passing it to bash -c. The current code goes further: it passes an argument array to proc_open() and runs a fixed script that receives the options as "$@", so no request value is ever parsed by a shell.

Two practical consequences follow. First, the attacker-controlled input sits in ordinary request fields, so web server access logs and any proxy logs that record the Host header are your best evidence. Second, the vulnerable proxy.php in 26.4.302 includes no Nextcloud bootstrap at all, which fits Collabora’s warning that disabling the app does not help: if the web server serves the file, it runs.

Timeline

A month passed between a public fix and a CVE. Collabora, according to BleepingComputer, attributed much of the delay to GitHub’s CVE-processing backlog. Whatever the reason, anyone who waited for a CVE or a scanner signature before updating was exposed for the entire window, which is why the hunt below matters more than the patch date. Our explainer on CISA BOD 26-04 covers what KEV’s “forensic triage: yes” flag asks federal agencies to do. Private teams can borrow the same approach.

What to do now

1. Decide whether you need the built-in server. If you only installed it to try Nextcloud Office, remove it:

   sudo -u www-data php occ app:remove richdocumentscode
   ls -d apps/richdocumentscode 2>/dev/null && echo "directory still present"
   

   Confirm the directory is actually gone. A leftover proxy.php is the risk.

2. Otherwise update it. The latest release at the time of writing is 26.4.502 (October 23). Anything at or above 26.4.303 contains the fix.

   sudo -u www-data php occ app:update richdocumentscode
   sudo -u www-data php occ app:list | grep 'richdocumentscode:'
   

3. If you are on Nextcloud 29 or older, 26.4.303 will not install, because the app now requires Nextcloud 30. Remove the app or upgrade Nextcloud first. Those Nextcloud releases are end of life.

4. Block the file at the edge as a stopgap if neither is possible in the next few hours. Denying requests to /apps/richdocumentscode/proxy.php at the reverse proxy breaks the built-in server, but it removes the unauthenticated entry point. This is a stopgap of our own, not vendor guidance, and it does nothing about a shell that is already there.

How to hunt

Run these checks whether or not you have already patched. The indicators below come from administrators’ reports in the app’s GitHub issue #354, as summarized by eSecurityPlanet and WZ-IT; we could not read the issue directly, so treat them as a starting point, not a complete list.

Files

cd /var/www/nextcloud   # your Nextcloud root

# Reported web shell names, then any PHP file that is not part of the release
find apps/richdocumentscode -maxdepth 2 \( -name 'shx*.php' -o -name 'shrf4645.php' \)
sudo -u www-data php occ integrity:check-app richdocumentscode

integrity:check-app compares the app directory with the signed release and lists extra files as EXTRA_FILE. A clean result after an update is good news; a hit means you go to the response steps below. Also look for recently modified PHP files elsewhere under apps/ and in the data directory, since an attacker with a shell can write anywhere the web server account can.

Web server logs

# Requests to proxy.php that carry shell syntax, raw or URL-encoded
zgrep -hiE 'richdocumentscode/proxy\.php' /var/log/nginx/access.log* /var/log/apache2/access.log* 2>/dev/null \
  | grep -iE '\$\(|%24%28|\$\{IFS\}|%24%7BIFS|%2e%2e'

We ran the find and log-search commands above against sample files with GNU findutils and grep to confirm they match the reported patterns; adapt the paths to your install. The reported patterns are $( or %24%28 (command substitution), ${IFS} (used to avoid spaces) and %2e%2e (path traversal), along with bursts of proxy.php?status requests. Because the injected value can travel in the Host header, check whether your log format records it; the default combined format does not. If it does not, look at reverse proxy or load balancer logs that do. Go back to at least September 10, 2026.

Host signals

• Outbound connections from the web server to webhook.site or other request-capture services, which reported payloads used to send back system information.
• Failed sudo attempts by www-data or your equivalent web server user in the auth log.
• New cron entries, SSH keys or processes owned by the web server user.

Reported post-exploitation activity included searches for password manager files, cryptocurrency wallets and keystores. Published reporting we reviewed does not confirm data exfiltration or root access.

If you find a web shell

The web server account can read Nextcloud’s config/config.php, which holds the database password, the instance secret and any object storage, SMTP or other service credentials configured there. It can also read every file in the data directory.

1. Preserve the suspicious files and logs before you delete anything.
2. Isolate the host, then rebuild it or restore from a backup taken before the first suspicious request. Deleting the shell does not remove anything else the attacker set up.
3. Rotate every secret in config.php and any credential the web server account could reach.
4. Tell users whose files were on the server, and follow your own incident and notification obligations.

Prioritizing this against everything else

This one does not need a scoring debate. It has an active-exploitation SSVC value, it is in KEV, it needs no credentials, and the vulnerable component is reachable on the same host and port as Nextcloud. If you use the three signals together, as we argue in CVSS vs EPSS vs KEV, every one of them points the same way. CISA’s SSVC values are explained in our guide to reading Vulnrichment SSVC data.

Limits of this article

We could not read Collabora’s advisory (GHSA-g3vx-3m76-fghh), the Nextcloud forum warning or GitHub issue #354 directly. Statements attributed to them come from the CVE record, CISA’s KEV entry and press coverage, and are labelled as such. The root-cause description is our reading of the public source diff. We have not tested exploitation, and the indicator list comes from early victim reports, so absence of these indicators is not proof that a server is clean.

Sources and verification

Vulnerability ManagementIncident ResponseNextcloudCommand Injection