Full Report
Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw
Analysis Summary
# Vulnerability: Unauthenticated Command Injection in Nextcloud Collabora Online CODE Server
## CVE Details
- **CVE ID**: CVE-2026-110447
- **CVSS Score**: Not explicitly listed, but characterized as "Critical" based on unauthenticated RCE capability.
- **CWE**: CWE-78 (Improper Neutralization of Special Elements used in an OS Command / OS Command Injection)
## Affected Systems
- **Products**: Nextcloud app "Collabora Online - Built-in CODE Server" (package name: `richdocumentscode`).
- **Versions**: All versions prior to 26.4.303.
- **Configurations**:
- The vulnerability is specific to the "Built-in CODE Server" app used for local document editing.
- **Note**: The flaw is only exploitable when the local document server is **not running** (e.g., during restarts, upgrades, or after a crash), as the vulnerable script (`proxy.php`) only executes the injection-prone command to start the service.
## Vulnerability Description
The `proxy.php` script in the affected app is responsible for starting the local CODE server when a request arrives and the service is idle. In vulnerable versions, the script takes text from the incoming request (including the URL path) and places it directly into a double-quoted bash command. Because the script fails to sanitize this input, an attacker can use shell expansion syntax (e.g., `$(...)`) within the request path to execute arbitrary system commands with the privileges of the web server user (`www-data` or similar).
## Exploitation
- **Status**: Exploited in the wild (first logged attacks reported September 10, 2026).
- **Complexity**: Low
- **Attack Vector**: Network (Remote)
## Impact
- **Confidentiality**: High (Attackers observed searching for password managers, crypto wallets, and system info).
- **Integrity**: High (Attackers can plant web shells to modify files and system states).
- **Availability**: High (Ability to execute commands can lead to service disruption).
## Remediation
### Patches
- **Update to Version 26.4.303 or later.**
- **Note**: Fixed versions require **Nextcloud 30 or later**. Users on EOL versions (Nextcloud 29 and older) must upgrade their Nextcloud instance to receive the patch.
### Workarounds
- **Uninstall the App**: Simply disabling the app is **insufficient** because `proxy.php` remains accessible to the web server. The app must be completely removed if it cannot be updated.
- **Switch Configuration**: Use a standalone Collabora Online server (Docker or Linux package) via the `richdocuments` app, which is not affected.
## Detection
- **Indicators of Compromise**:
- Presence of unexpected PHP files in the `richdocumentscode` app folder (web shells).
- Failed `sudo` attempts in system logs.
- Outbound connections to `webhook[.]site` or similar data exfiltration services.
- Search activity in logs for sensitive files like `*.kdbx`, `wallet.dat`, or `.bitcoin`.
- **Detection methods and tools**:
- Run the **Nextcloud Integrity Check** to identify modified or unauthorized files.
- Review web server access logs for requests to `proxy.php?status` containing shell metacharacters.
## References
- Collabora Security Advisory: [https://github[.]com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh]
- GitHub Issue Report: [https://github[.]com/CollaboraOnline/richdocumentscode/issues/354]
- Nextcloud Community Warning: [https://help[.]nextcloud[.]com/t/to-collabora-built-in-user-update-asap/250516]
- CVE Record: [https://www[.]cve[.]org/CVERecord?id=CVE-2026-110447]