Attackers plant web shells on Nextcloud servers through Collabora's built-in CODE app
Attackers exploited CVE-2026-110447 in Nextcloud's built-in Collabora CODE app to plant web shells, with the first logged attack on September 10. Collabora says disabling the app does not help, so administrators must update to 26.4.303 or remove it.
The Watch · Security desk
Timeline: September 10, first logged attack. September 11, fix in 26.4.303. September 14, another attempt on an updated server, no new shell file. October 3, forum warning on which installs are not affected. October 14, Collabora advisory CVE-2026-110447.
- 2026First logged attack, per administrators' GitHub reports, claim 2
- 2026Collabora fixes the flaw in version 26.4.303, claim 4
- 2026Updated server logs another attempt; no new shell file appears, claim 20
- 2026Forum warning: installs without the built-in app not affected, claim 17
- 2026Collabora publishes advisory CVE-2026-110447, claim 5
| Date | Event | Claim |
|---|---|---|
| September 10, 2026 | First logged attack, per administrators' GitHub reports | 2 |
| September 11, 2026 | Collabora fixes the flaw in version 26.4.303 | 4 |
| September 14, 2026 | Updated server logs another attempt; no new shell file appears | 20 |
| October 3, 2026 | Forum warning: installs without the built-in app not affected | 17 |
| October 14, 2026 | Collabora publishes advisory CVE-2026-110447 | 5 |
What happened
- The command runs only while the app's local document server is down, such as during a restart, an upgrade or after a crash.
- In versions up to 26.4.302, proxy.php put request text, including the path, inside a double-quoted bash command, where the shell still runs anything written as $(...).
- One administrator's logs record two requests from a single IP address, each with a command hidden in the path: the first on September 10 at 19:51 and the second on September 11 at 09:56, both UTC+2.
- On one server the attacker then used the shell to search for credential stores and wallets, including *.kdbx, wallet.dat and keystore.json files.
- Two other administrators reported the same, one after Nextcloud's integrity check flagged a new PHP file and one after emails about failed sudo attempts.
Why it matters
- Who has to decide decision The first call is inventory. Only installs with the built-in richdocumentscode app are in scope, and a separate Collabora server, in Docker, from a Linux package or hosted, takes an install out of it.
- What it limits constraint Nextcloud 29 and older cannot take the fix, which needs Nextcloud 30 or later, and the app store still serves them an affected version. Those operators have to upgrade Nextcloud or remove the app.
- What it costs cost Updating closes the entry. Removing a shell already written is a separate job, and mmeeks told users to delete any leftover shx*.php files.
- What it sets up precedent proxy.php has now produced two command-injection flaws. The fix for CVE-2025-66208 did not prevent CVE-2026-110447.
Next story · Security · Oct 7
Attackers hit Atlassian's CVE-2026-21589 two hours after watchTowr published the techniqueConfirmed6 publishers
Exploitability is high wherever the app is installed. The attacker needs no login, only a request whose path carries a $(...) command [7]. Collabora's advisory covers every version before 26.4.303 [16]. The timing condition has not stopped anyone: three administrators reported attacks on GitHub [2]. Nobody should count it as a defense.
The first logged attack was on September 10 [2], Collabora shipped 26.4.303 on September 11 [4], and a warning went up on the Nextcloud community forum on October 3 [17]. The CVE identifier did not arrive until October 14 [5], 33 days after the fix [23]. Anyone matching on CVE numbers had no identifier to match until then. All of it is public: the GitHub reports, the forum post and the advisory. The attacker-side detail comes from administrators' reports as summarized by The Hacker News [2].
The affected script, plain PHP that the web server executes straight from the app's folder, loads none of Nextcloud's code [8]. We think that explains why switching the app off does not help: the entry point sits outside Nextcloud's own request handling. The app downloads a copy of Collabora Online Development Edition and runs it on the Nextcloud server itself, so Nextcloud Office can edit documents without a separate Collabora server [14]. Its store listing says it is "for local testing and non-production use" and "for personal use or for small teams" [15]. The report does not say how many installations run it.
Two source IP addresses appear in the reports. One sent the September 10 and 11 requests [9]. A second sent an attempt on September 14, against a server already updated to 26.4.303, with a payload of the same kind [20]. No new shell file appeared, and the CODE server that attempt started carried the attack text only in its startup options [20]. The output "looks scary but should be harmless," mmeeks said [21]. Two addresses over five days of attempts is a repeat pattern. The reports do not show whether one actor is behind both.
The first-stage command dropped a one-line PHP shell in the app's folder and attempted to post the output of uname -a from the server to a webhook.site address [10]. The administrator who reviewed the requests found no commands that archived, uploaded or copied out files, but wrote that anything the web server account can read must be treated as potentially exposed [12]. None of the three reports shows root access [13].
What to watch
- More shx*.php finds or new source IP addresses on the GitHub thread would show the spread beyond three reports.
- Any report of files archived, uploaded or copied out, or of root access, would move this from web-shell access to confirmed data loss.
- Whether the Nextcloud app store stops serving an affected version to Nextcloud 29 and older installs.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence80
Perspective Coverage
5 publishers- Builder
- Builder 24%
- Operator
- Operator 65%
- Investor
- Investor 11%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Attackers exploited a flaw in the optional Nextcloud app Collabora Online - Built-in CODE Server to plant web shells on Nextcloud servers.
- [2]
Three administrators reported the issue on GitHub, with the first logged attack on September 10.
- [3]
The flaw allows an unauthenticated request to run a command on the server, but only when the app's local document server is not running, such as during a restart or upgrade, or after a crash.
- [4]
Collabora fixed the flaw in version 26.4.303 on September 11.
- [5]
On October 14 Collabora published an advisory with the identifier CVE-2026-110447.
- [6]
"It is not sufficient to disable the app to avoid the problem; it must be upgraded to >= 26.4.303 or removed," Collabora said in the advisory.
- [7]
The app's proxy.php script starts the local CODE server whenever a request arrives and nothing is listening. In versions up to 26.4.302 it placed text from the request, including its path, inside a double-quoted bash command, where the shell still runs anything written as $(...), so a command hidden in the path ran as the web server user.
- [8]
The script is a plain PHP file that the web server runs directly from the app's folder and loads none of Nextcloud's code.
- [9]
Access logs from two of the first administrator's servers show requests at 19:51 on September 10 and 09:56 on September 11 (UTC+2), both from one IP address and both aimed at proxy.php?status with a shell command hidden in the request path. All of that administrator's servers ran version 26.4.302.
- [10]
The command decoded a one-line PHP web shell into the app's folder and tried to send the server's uname -a output to a webhook.site address.
- [11]
On one server, the attacker used the shell to search for credential stores and cryptocurrency wallets, including *.kdbx, wallet.dat and keystore.json files.
- [12]
The reviewed requests showed no commands that archived, uploaded, or copied out files, but anything the web server account can read must be treated as potentially exposed, the administrator wrote.
- [13]
Two other administrators reported the same on their own instances: one found the shell when Nextcloud's integrity check flagged a new PHP file, and the other learned of the break-in from emails about failed sudo attempts. None of the reports show the attacker gaining root access.
- [14]
The app, package name richdocumentscode, downloads a copy of Collabora Online Development Edition and runs it on the Nextcloud server itself, so Nextcloud Office can edit documents without a separate Collabora server.
- [15]
The app's store listing says it is "for local testing and non-production use" and "for personal use or for small teams."
- [16]
Collabora's advisory covers every version before 26.4.303 and says standalone Collabora Online servers are not affected.
- [17]
A warning posted on the Nextcloud community forum on October 3 stated that an installation is not affected if it uses only the Nextcloud Office app (richdocuments) without the built-in app, whether its Collabora server runs in Docker, from a Linux package, or at a hosting provider.
- [18]
The fixed versions require Nextcloud 30 or later. Nextcloud 29 and older are end of life, and the app store still serves them an affected version, so their users should upgrade Nextcloud or remove the app.
- [19]
Collabora's fix for a separate command-injection flaw in the same script, CVE-2025-66208, disclosed last December, does not prevent this one.
- [20]
After one administrator updated to 26.4.303, that server logged another attempt on September 14 from a second IP address with a payload of the same kind. The CODE server it started carried the attack text in its startup options, but no new shell file appeared.
- [21]
mmeeks, who answered for the project in the thread, said the output "looks scary but should be harmless," and told users to update.
- [22]
mmeeks told users to update and to remove any leftover shx*.php files.
- [23]
Collabora's CVE advisory (October 14) came 33 days after the September 11 fix.
Sources
5 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comHackers exploit Collabora RCE flaw to backdoor Nextcloud servers
1 article · October 15, 2026
- dev.toNextcloud security flaw allows sensitive data to be stolen
1 article · October 14, 2026
- github.comAttack reports
1 article · October 15, 2026
- scworld.comVulnerability in Nextcloud app allowed attackers to plant web shells
1 article · October 15, 2026
- thehackernews.comHackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
1 article · October 14, 2026
Topics and entities
Topics
- Web shell attacks
- Command Injection
- Self-hosted software security
- CVE disclosure delays
Entities
- Collabora Online
- Collabora Online - Built-in CODE Server (richdocumentscode)