Full Report
Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. [...]
Analysis Summary
# Vulnerability: Critical OS Command Injection in Nextcloud Collabora Online Built-in CODE Server
## CVE Details
- **CVE ID:** CVE-2026-110447
- **CVSS Score:** 9.8 (Critical) - *Estimated based on characteristics*
- **CWE:** CWE-78 (OS Command Injection)
## Affected Systems
- **Products:** Collabora Online - Built-in CODE Server app (`richdocumentscode`) for Nextcloud.
- **Versions:** All versions prior to **26.4.303**.
- **Configurations:** The vulnerability specifically impacts the **optional built-in app**. Standalone Collabora servers (Docker, RPM/DEB) and Nextcloud All-in-One (AiO) deployments are reported as **unaffected**.
- **Prerequisite:** The built-in CODE server must be in a "stopped" state (e.g., following a system reboot, crash, or manual stop) for the injection to be triggered.
## Vulnerability Description
The flaw resides in the app’s mechanism for initializing the bundled Collabora server. By sending a specially crafted malicious request to the `proxy.php` endpoint, an attacker can trigger OS command injection. This occurs because the app fails to properly sanitize inputs before passing them to system commands used to start the server process.
## Exploitation
- **Status:** **Exploited in the wild.** Reports indicate active exploitation began as early as September 10, 2026.
- **Complexity:** Low (No authentication or user interaction required).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** Total (Attackers have been observed searching for password databases, password managers, and crypto wallets).
- **Integrity:** Total (Installation of PHP webshells and backdoors).
- **Availability:** High (Potential for ransomware deployment and unauthorized system control).
## Remediation
### Patches
- **Update to version 26.4.303** or later via the Nextcloud app store immediately.
### Workarounds
- **Uninstall the App:** If the built-in CODE server is not required, remove the `richdocumentscode` app entirely.
- **Note:** The vendor warns that simply **disabling** the app is insufficient to mitigate the risk; it must be updated or fully removed.
## Detection
- **Indicators of Compromise (IoCs):**
- Presence of unexpected PHP webshells in the Nextcloud webroot.
- Unusual outbound network traffic to known malicious IPs.
- Evidence of automated searches for files containing "wallet," "password," or ".db" extensions.
- **Detection Methods:**
- Monitor web server logs for suspicious requests targeting the `proxy.php` endpoint of the `richdocumentscode` app.
- Audit system process logs for unauthorized commands initiated by the web server user (e.g., `www-data`).
## References
- **Collabora Security Advisory:** hxxps[://]github[.]com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh
- **GitHub Advisory:** hxxps[://]github[.]com/advisories/GHSA-f97p-r72q-64h2
- **NVD Detail:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/cve-2026-110447
- **Vendor Blog:** hxxps[://]www[.]collaboraonline[.]com/blog/stay-safe-upgrade-everything-regularly/
- **Community Discussion:** hxxps[://]github[.]com/CollaboraOnline/richdocumentscode/issues/354