Critical Nextcloud Collabora Online Flaw CVE-2026-110447 Actively Exploited in the Wild to Deploy Webshells
Do Son 
TL;DR
Threat actors are actively exploiting CVE-2026-110447, a critical OS command injection flaw in the Nextcloud Collabora Online Built-in CODE Server app (richdocumentscode). Rated 9.2 on the CVSS scale, this Nextcloud Collabora Online RCE vulnerability lets unauthenticated attackers plant PHP webshells on exposed servers. Administrators must update the app to version 26.4.303 or later and audit their systems for compromise immediately.
- CVE: CVE-2026-110447
- CVSS: 9.2 (Critical · CVSSv4)
- Product: Collabora Online - Built-in CODE Server
- Affected: < 26.4.303
- Status: Exploited in the wild
- Patched in: 26.4.303
- Action: Update to 26.4.303 now
Why CVE-2026-110447 Matters for Nextcloud Administrators
Thousands of self-hosted cloud administrators install the built-in Collabora Online Development Edition (CODE) server app to enable document editing inside Nextcloud. However, attackers have actively exploited this flaw in the wild throughout September and October 2026. Note that CVE-2026-110447 is a distinct vulnerability from the older CVE-2025-66208 flaw.
According to a Nextcloud community alert urging built-in Collabora users to update immediately, multiple operators discovered unauthorized PHP webshells on their hosts. Once attackers establish access as the web server account, they execute discovery commands targeting password databases and cryptocurrency wallets. Specifically, incident responders observed searches for *.kdbx, wallet.dat, keystore.json, Bitwarden, 1Password, and Bitcoin, Monero, or Ethereum directories.
How the Nextcloud Collabora Online RCE Attack Works
OS Command Injection in proxy.php
The vulnerability resides in how the richdocumentscode wrapper launches the Collabora AppImage through a PHP execution call. Specifically, an OS command injection condition occurs in proxy.php when the CODE server is not running, such as after a system restart. Attackers send crafted HTTP GET requests to the /apps/richdocumentscode/proxy.php?status endpoint using encoded path traversal sequences (%2e%2e).
Shell Substitution and Webshell Deployment
Detailed forensics shared in the Collabora Online richdocumentscode GitHub issue #354 show how the exploit chain operates in practice. When the server processes the request URL, it passes unescaped path values into the remote_font_config.url argument while starting Collabora_Online.AppImage. Consequently, shell command substitution expressions using $() and ${IFS} whitespace obfuscation execute directly via sh.
Afterward, the decoded Base64 payload drops a PHP webshell matching the filename pattern /apps/richdocumentscode/shx*.php or shrf*.php. Additionally, the script sends system identification output to external webhook.site URLs to confirm successful infection.
Affected Products and Versions
Based on vendor documentation and community incident reports, only specific Nextcloud setups are vulnerable:
- Affected: Nextcloud Collabora Online – Built-in CODE Server (
richdocumentscode) version 26.4.302 and older. - Not Affected: Standalone Collabora Online servers deployed via Docker, Linux distribution packages, or external hosting providers, as well as Nextcloud instances running only the connector app (
richdocuments) withoutrichdocumentscode.
Patch Details and Mitigation Steps
Maintainers patched the Nextcloud Collabora Online command injection flaw in richdocumentscode version 26.4.303. Therefore, administrators should upgrade to version 26.4.303 or newer right away, or remove the built-in server app if unused. Because patching does not remove existing backdoors, teams must also inspect /apps/richdocumentscode/ for rogue shx*.php files, terminate suspicious www-data processes, and rotate all secrets accessible to the web server user.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
