# Collabora CODE CVE-2026-110447: Patch Nextcloud, Then Hunt

> CVE-2026-110447 is an unauthenticated OS command injection in proxy.php of the Collabora Online Built-in CODE Server app for Nextcloud (richdocumentscode) before 26.4.303. It was exploited from September, a month before the CVE was published, and CISA added it to KEV on October 23. Update or remove the app, then hunt for web shells.

- URL: https://firewallsync.com/posts/collabora-code-cve-2026-110447-nextcloud-patch-and-hunt/
- Site: FirewallSync (https://firewallsync.com/)
- Topic: Security Operations
- Tags: vulnerability management, incident response, nextcloud, command injection
- Published: 2026-10-24
- Author: Craig Leslie

## Key takeaways

- Only the Nextcloud app "Collabora Online - Built-in CODE Server" (richdocumentscode) before 26.4.303 is affected. Standalone Collabora Online servers, including Docker and package installs used through the Nextcloud Office (richdocuments) connector, are not, per the CVE record and Collabora's advisory as reported.
- The flaw is an unauthenticated OS command injection in proxy.php that fires when the bundled CODE server is not running, for example after a restart, upgrade or crash. Commands run as the web server account.
- The fix (26.4.303) shipped on September 11, 2026. The CVE was published on October 14 and CISA added it to KEV on October 23 with a federal due date of October 26. Exploitation reports go back to September 10.
- Update richdocumentscode to the current release or remove it. Collabora says disabling the app is not enough; the vulnerable proxy.php does not load Nextcloud before it runs.
- Patching does not remove a web shell. Check apps/richdocumentscode for unexpected PHP files, search access logs for proxy.php requests carrying shell syntax, and rotate secrets the web server account could read if you find anything.



If your Nextcloud server runs the **Collabora Online - Built-in CODE Server** app (`richdocumentscode`) at any version before 26.4.303, treat it as exposed to unauthenticated remote code execution. Update the app to the current release or remove it today, then hunt for web shells: the fix shipped on September 11, 2026, attacks were reported from September 10, and the CVE was not published until October 14. CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities (KEV) catalog on October 23, with a due date of October 26 for US federal civilian agencies.

## Are you affected?

The CVE record is specific: the flaw is "not present in standalone Collabora Online servers; only this deployment with CODE Server is affected."

| Deployment | Affected? | Basis |
|---|---|---|
| `richdocumentscode` app before 26.4.303 | Yes | CVE record |
| `richdocumentscode` 26.4.303 or later | No | CVE record (fixed version) |
| Nextcloud Office (`richdocuments`) pointed at a separately run Collabora Online server (Docker, DEB/RPM, appliance) | No | CVE record; Collabora advisory as reported |
| Nextcloud All-in-One | No | Collabora, as reported by BleepingComputer |
| Nextcloud 29 or older with the app installed | Upgrade Nextcloud or remove the app; 26.4.303 needs Nextcloud 30 or later | App metadata (`min-version="30"`); advisory as reported |

The two app names are easy to confuse. `richdocuments` is the Nextcloud Office connector. `richdocumentscode` is the optional app that bundles a CODE (Collabora Online Development Edition) AppImage and starts it on the Nextcloud host. Only the second is in scope.

Check which you have from the Nextcloud directory:

```bash
# Run as the web server user; adjust the user and path for your install
sudo -u www-data php occ app:list | grep -E 'richdocuments(code)?:'
```

## The vulnerability

| Field | Value |
|---|---|
| CVE | CVE-2026-110447 |
| Product | Collabora Online - Built-in CODE Server (`richdocumentscode`), a Nextcloud app |
| Affected | All versions before 26.4.303 |
| Weakness | CWE-78, OS command injection, in `proxy.php` |
| Condition | The CODE server is not running, "e.g., the product was recently restarted" |
| CVSS 4.0 | 9.2 Critical, `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N` |
| CISA SSVC | Exploitation: active; Automatable: yes; Technical Impact: total |
| KEV | Added October 23, 2026; due October 26, 2026; forensic triage: yes |

The `AT:P` (attack requirements present) in the vector reflects that precondition: the bundled server has to be down. That is less of a barrier than it sounds. Restarts, app upgrades and crashes all stop it, and in the vulnerable code an unauthenticated `?status` request to `proxy.php` is what asks for the server to be started when it is not running. If you are new to v4.0 vectors, our guide to [reading a CVSS v4.0 vector string](/posts/how-to-read-a-cvss-v4-0-vector-string-metric-by-metric-with-real-cve-records/) walks through each metric.

The CVE record also says this is "a different vulnerability than CVE-2025-66208", so a host patched for that earlier issue is not covered.

### What the fix changed

The CVE record describes the bug only as command injection in `proxy.php`. The app's public repository shows more. This section is our reading of that source, not a vendor statement.

In 26.4.302, `startCoolwsd()` built the launch command as one string. Two values derived from the request, the HTTP `Host` header and the request URI (used to build a font-configuration URL), were each passed through PHP's `escapeshellarg()`, which wraps them in single quotes. The whole command was then placed inside a double-quoted `bash -c "..."` string and handed to the shell. Single quotes have no special meaning inside double quotes, so shell command substitution in those values was still evaluated by the outer shell.

The 26.4.303 change, committed on September 9, wraps the entire inner command in `escapeshellarg()` before passing it to `bash -c`. The current code goes further: it passes an argument array to `proc_open()` and runs a fixed script that receives the options as `"$@"`, so no request value is ever parsed by a shell.

Two practical consequences follow. First, the attacker-controlled input sits in ordinary request fields, so web server access logs and any proxy logs that record the `Host` header are your best evidence. Second, the vulnerable `proxy.php` in 26.4.302 includes no Nextcloud bootstrap at all, which fits Collabora's warning that disabling the app does not help: if the web server serves the file, it runs.

## Timeline

| Date (2026) | Event | Source |
|---|---|---|
| September 9 | Fix committed to `proxy.php` | richdocumentscode repository |
| September 10 | Earliest attacks reported by administrators | BleepingComputer, eSecurityPlanet |
| September 11 | 26.4.303 released; GitHub issue #354 opened by affected admins | Repository tag and changelog; WZ-IT |
| October 3 | Community warning on the Nextcloud forum to update immediately | BleepingComputer |
| October 14 | CVE published; Collabora advisory GHSA-g3vx-3m76-fghh | CVE record |
| October 23 | CISA adds the CVE to KEV; app 26.4.502 released | KEV catalog; repository changelog |
| October 26 | KEV due date for US federal civilian agencies | KEV catalog |

A month passed between a public fix and a CVE. Collabora, according to BleepingComputer, attributed much of the delay to GitHub's CVE-processing backlog. Whatever the reason, anyone who waited for a CVE or a scanner signature before updating was exposed for the entire window, which is why the hunt below matters more than the patch date. Our explainer on [CISA BOD 26-04](/posts/cisa-bod-26-04-explained-kev-deadlines-forensic-triage-and-what-private-teams-can-borrow/) covers what KEV's "forensic triage: yes" flag asks federal agencies to do. Private teams can borrow the same approach.

## What to do now

1. **Decide whether you need the built-in server.** If you only installed it to try Nextcloud Office, remove it:

   ```bash
   sudo -u www-data php occ app:remove richdocumentscode
   ls -d apps/richdocumentscode 2>/dev/null && echo "directory still present"
   ```

   Confirm the directory is actually gone. A leftover `proxy.php` is the risk.

2. **Otherwise update it.** The latest release at the time of writing is 26.4.502 (October 23). Anything at or above 26.4.303 contains the fix.

   ```bash
   sudo -u www-data php occ app:update richdocumentscode
   sudo -u www-data php occ app:list | grep 'richdocumentscode:'
   ```

3. **If you are on Nextcloud 29 or older**, 26.4.303 will not install, because the app now requires Nextcloud 30. Remove the app or upgrade Nextcloud first. Those Nextcloud releases are end of life.

4. **Block the file at the edge as a stopgap** if neither is possible in the next few hours. Denying requests to `/apps/richdocumentscode/proxy.php` at the reverse proxy breaks the built-in server, but it removes the unauthenticated entry point. This is a stopgap of our own, not vendor guidance, and it does nothing about a shell that is already there.

## How to hunt

Run these checks whether or not you have already patched. The indicators below come from administrators' reports in the app's GitHub issue #354, as summarized by eSecurityPlanet and WZ-IT; we could not read the issue directly, so treat them as a starting point, not a complete list.

### Files

```bash
cd /var/www/nextcloud   # your Nextcloud root

# Reported web shell names, then any PHP file that is not part of the release
find apps/richdocumentscode -maxdepth 2 \( -name 'shx*.php' -o -name 'shrf4645.php' \)
sudo -u www-data php occ integrity:check-app richdocumentscode
```

`integrity:check-app` compares the app directory with the signed release and lists extra files as `EXTRA_FILE`. A clean result after an update is good news; a hit means you go to the response steps below. Also look for recently modified PHP files elsewhere under `apps/` and in the data directory, since an attacker with a shell can write anywhere the web server account can.

### Web server logs

```bash
# Requests to proxy.php that carry shell syntax, raw or URL-encoded
zgrep -hiE 'richdocumentscode/proxy\.php' /var/log/nginx/access.log* /var/log/apache2/access.log* 2>/dev/null \
  | grep -iE '\$\(|%24%28|\$\{IFS\}|%24%7BIFS|%2e%2e'
```

We ran the `find` and log-search commands above against sample files with GNU findutils and grep to confirm they match the reported patterns; adapt the paths to your install. The reported patterns are `$(` or `%24%28` (command substitution), `${IFS}` (used to avoid spaces) and `%2e%2e` (path traversal), along with bursts of `proxy.php?status` requests. Because the injected value can travel in the `Host` header, check whether your log format records it; the default combined format does not. If it does not, look at reverse proxy or load balancer logs that do. Go back to at least September 10, 2026.

### Host signals

- Outbound connections from the web server to `webhook.site` or other request-capture services, which reported payloads used to send back system information.
- Failed `sudo` attempts by `www-data` or your equivalent web server user in the auth log.
- New cron entries, SSH keys or processes owned by the web server user.

Reported post-exploitation activity included searches for password manager files, cryptocurrency wallets and keystores. Published reporting we reviewed does not confirm data exfiltration or root access.

## If you find a web shell

The web server account can read Nextcloud's `config/config.php`, which holds the database password, the instance secret and any object storage, SMTP or other service credentials configured there. It can also read every file in the data directory.

1. Preserve the suspicious files and logs before you delete anything.
2. Isolate the host, then rebuild it or restore from a backup taken before the first suspicious request. Deleting the shell does not remove anything else the attacker set up.
3. Rotate every secret in `config.php` and any credential the web server account could reach.
4. Tell users whose files were on the server, and follow your own incident and notification obligations.

## Prioritizing this against everything else

This one does not need a scoring debate. It has an active-exploitation SSVC value, it is in KEV, it needs no credentials, and the vulnerable component is reachable on the same host and port as Nextcloud. If you use the three signals together, as we argue in [CVSS vs EPSS vs KEV](/posts/cvss-vs-epss-vs-kev-which-signal-should-decide-what-you-patch-first/), every one of them points the same way. CISA's SSVC values are explained in our guide to [reading Vulnrichment SSVC data](/posts/cisa-vulnrichment-how-to-read-ssvc-values-in-a-cve-record-and-turn-them-into-a-patch-decision/).

## Limits of this article

We could not read Collabora's advisory (GHSA-g3vx-3m76-fghh), the Nextcloud forum warning or GitHub issue #354 directly. Statements attributed to them come from the CVE record, CISA's KEV entry and press coverage, and are labelled as such. The root-cause description is our reading of the public source diff. We have not tested exploitation, and the indicator list comes from early victim reports, so absence of these indicators is not proof that a server is clean.

## Sources and verification

| Important claim | Source | Verification |
|---|---|---|
| Affected before 26.4.303; OS command injection in `proxy.php` when the CODE server isn't running; exploited in September and October 2026; distinct from CVE-2025-66208; standalone servers not affected; CWE-78; CVSS 4.0 9.2 and vector; published October 14 | [CVE-2026-110447 record](https://www.cve.org/CVERecord?id=CVE-2026-110447) (read via the cvelistV5 repository) | Verified |
| SSVC: Exploitation active, Automatable yes, Technical Impact total | CISA ADP container in the CVE record | Verified |
| KEV addition October 23, due October 26, forensic triage flag, BOD 26-04 required action | [CISA KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (JSON feed, catalog version 2026.10.23) | Verified |
| Fix committed September 9; 26.4.303 released September 11; 26.4.502 released October 23; Nextcloud 30 minimum; `Host` header and request URI in the launch command; standalone `proxy.php`; `?status` starts the server | [richdocumentscode repository](https://github.com/CollaboraOnline/richdocumentscode) (tags 26.4.302, 26.4.303, 26.4.502 and CHANGELOG) | Verified from source; root-cause reading is editorial |
| "Disabling the app is insufficient"; Docker, package and All-in-One installs not affected; attacks from September 10; October 3 forum warning; Collabora's comments on CVE delay | [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/) | Qualified: secondary report of vendor and admin statements |
| Web shell names, log patterns, webhook.site callbacks, sudo attempts, data searched for | [eSecurityPlanet](https://www.esecurityplanet.com/threats/news-collabora-nextcloud-cve-2026-110447/); [WZ-IT](https://wz-it.com/en/blog/nextcloud-built-in-code-server-cve-2026-110447-rce-webshell/) | Qualified: secondary summaries of GitHub issue #354 |
| `occ integrity:check-app` reports extra files | WZ-IT | Qualified |

## Frequently asked questions

### Is my Nextcloud affected by CVE-2026-110447?

Only if the app "Collabora Online - Built-in CODE Server" (app ID richdocumentscode) is installed at a version before 26.4.303. Run occ app:list and look for richdocumentscode. If you use Nextcloud Office with a separately run Collabora Online server, the CVE record says that deployment is not affected.

### Is disabling the built-in CODE server app enough?

No. Collabora's guidance, as reported by BleepingComputer and eSecurityPlanet, is that disabling is insufficient: update to 26.4.303 or later, or remove the app. In the 26.4.302 source, proxy.php does not load Nextcloud at all, so a disabled app's file can still be requested directly if the web server serves the app directory.

### What should I look for if I ran a vulnerable version?

Unexpected PHP files in apps/richdocumentscode, reported examples being shx*.php and shrf4645.php; requests to proxy.php containing $(, %24%28 or ${IFS}; outbound calls to webhook.site; and failed sudo attempts by the web server user. Review logs back to at least September 10, 2026.

### Why did CISA add it to KEV so late?

CISA added CVE-2026-110447 to KEV on October 23, nine days after the CVE was published on October 14. The fix had been available since September 11 and exploitation was reported from September 10, so KEV's date says nothing about when your exposure began.


Image credit: Photo by [Lan Gao](https://unsplash.com/photos/KBuWjEVavM8) on Unsplash