Design Partner Program
TLP:CLEAR SECURITY ADVISORY HRK-SA-2026-1028-06 Exploited in the wild

Collabora CODE Server RCE (CVE-2026-110447): unauthenticated command injection in Nextcloud

The built-in Collabora app starts its own document server, built from parts of the incoming request. Attackers have used it since September to drop web shells. Disabling the app does not help, and the update does not remove what was left behind. Upgrade to 26.4.303 or remove the app, then hunt.

SEVERITY
Critical
PEAK CVSS
9.2
AUTH REQUIRED
None
PUBLIC POC
Yes
PUBLISHED
Oct 28, 2026
REVISION
v1.0 · @Melly
01 · EXECUTIVE SUMMARY

Bottom line

Hayrok Research Lab is tracking a critical, unauthenticated command injection in the Collabora Online Built-in CODE Server app for Nextcloud. Attackers have used it since Sep 10 to plant web shells, and CISA added it to KEV on Oct 23. Disabling the app does not protect you, and the update does not remove a shell already dropped. Upgrade the app to 26.4.303 or later, or remove it, then hunt the server for what was left behind.

KEY JUDGMENTS
01
Exploitation began around Sep 10, 2026, and CISA added CVE-2026-110447 to its KEV catalog on Oct 23. Public exploit activity is documented.Observed
02
Disabling the app does not help. Collabora states the app must be upgraded or removed.Reproduced
03
The flaw fires when the local CODE server is offline, which includes during the upgrade itself. The fix shipped five weeks before the advisory, so patch-only monitoring missed it.Assessed
04
The app is often added by IT for convenience and may be absent from the security team's asset list entirely.Assessed
02 · VULNERABILITY DETAILS

Vulnerability summary

Collabora Built-in CODE Server command injection
CVE-2026-110447 NVD
9.2Critical
App
richdocumentscode (Built-in CODE Server)
Component
proxy.php service start path
Weakness
CWE-78 OS command injection
Affected
below 26.4.303, needs Nextcloud 30+ to fix
Scoring
9.2 · CVSS v4.0
Distinct from
CVE-2025-66208, an earlier flaw in the same script
Impact
Command execution as the web server user, and a web shell on the file server.
EXPOSURE: THE APP, BELOW THE FIX
01Built-in CODE Server presentrichdocumentscode below 26.4.303, even disabled.
02Reachableproxy.php reachable without a login.
03Local server offlineThe flaw fires during a restart, upgrade or crash.
04Prior compromiseA web shell may already be present on a late-patched server.
03 · THREAT ACTIVITY

Exploitation status and timeline

IN THE WILDObservedAttacks from Sep 10, KEV Oct 23.
PUBLIC POCAvailableExploit activity documented.
PATCHAvailable26.4.303 and later fix it.
RESIDUAL RISKWeb shellsUpdate does not remove dropped files.
DISCLOSURE AND ACTIVITY TIMELINE · 2026
Sep 10First attacks appear in admins' access logs.
Sep 11Collabora releases 26.4.303 with a corrected launch command. No security note.
Sep 14Collabora confirms in a GitHub issue that 26.4.303 fixes the flaw.
Oct 14Collabora publishes the advisory and the CVE, about five weeks after the fix.
Oct 23CISA adds it to KEV. Version 26.4.502 ships the same day.
04 · AFFECTED PRODUCTS

Affected and fixed versions

The update alone is not a verdict, because it does not remove a shell already dropped. A patched server still needs a compromise hunt.

SETUP
AFFECTED
ACTION
STATUS
richdocumentscode before 26.4.303
yes, even disabled
Upgrade to 26.4.303+, or remove
Fixed
26.4.303, 26.4.402, 26.4.502
no
Keep current, check for earlier compromise
Not affected
Nextcloud 29 or older with the app
yes
Upgrade Nextcloud, or remove the app
Affected
Standalone Collabora or Docker
no
Confirm built-in app not also present
Not affected
UPGRADE SAFELYThe flaw is reachable exactly when the local CODE server is down, which includes during the upgrade. Restrict outside access to Nextcloud while you apply the fix.
05 · RECOMMENDED ACTIONS

What to do, in priority order

CriticalImmediately
Nextcloud 30+ with the appUpdate richdocumentscode to 26.4.303 or later, then hunt for web shells.
App present but unusedRemove it. Disabling is not enough.
HighWithin 72 hours
Nextcloud 29 or older with the appThe fixed app needs Nextcloud 30. Upgrade Nextcloud, or remove the app.
Servers patched after SeptemberAssume possible prior compromise. Run the shell hunt.
If a newer release breaksRoll back to 26.4.303, never to an older version.
HighBefore closing
Every serverRecord the app version, the shell-hunt result and the log review as evidence.
WORKAROUNDS
Remove the app. The only reliable stopgap. Point Nextcloud Office at a standalone Collabora server instead.Block the sink. Block requests to proxy.php that carry shell characters such as $( or ${IFS} at the edge.Restrict access. Restrict outside access to Nextcloud while you work, if users can tolerate it.Keep hunting. The update does not remove a dropped shell. Hunt after you patch.
06 · DETECTION AND HUNTING

Observables and hunting queries

No stable file hashes are published. Hunt for the shx web shell naming pattern and the proxy.php injection in logs.

TYPE
OBSERVABLE
SOURCE
File
A file named shx*.php, often in the app folder
Filesystem on each server
Request
A proxy.php request carrying shell characters or path traversal
Nextcloud access logs
Behavior
Failed sudo attempts by the web server account
System auth logs
HUNT · CVE-2026-110447web shells by naming pattern
find /var/www/nextcloud -name 'shx*.php'
HUNT · CVE-2026-110447proxy.php abuse in logs
grep -E "proxy\.php\?status.*(\$\(|\$\{IFS\}|%2e%2e)" /var/log/nginx/access.log*
07 · MITRE ATT&CK

Technique mapping

TACTIC
ID
TECHNIQUE
BASIS
Initial Access
T1190
Exploit Public-Facing Application
Observed
Persistence
T1505.003
Server Software Component: Web Shell
Observed
08 · TECHNICAL ANALYSIS

Root cause and attack path

The Built-in CODE Server app starts the local Collabora service when it is not running, for example during a restart, an upgrade or after a crash. proxy.php builds that start command from parts of the incoming request. Before 26.4.303 it did not sanitize those parts.

An attacker slips shell syntax into the request path, such as $(...) for command substitution and ${IFS} to stand in for spaces. The server runs that text as part of its command, as the web server user. That is OS command injection, CWE-78. It is a different code path from CVE-2025-66208, and that earlier fix does not close this one. Observed payloads drop PHP web shells named shx followed by random characters, starting in the app folder.

01 OFFLINE
Local CODE server is down, during restart, upgrade or crash
Control: Restrict access during the upgrade
02 REQUEST
Attacker sends a crafted request to proxy.php
Control: Block shell characters at the edge
03 INJECT
Shell syntax becomes part of the start command
Control: Upgrade to 26.4.303 or remove the app
04 PERSIST
The server runs it, a web shell drops
Control: Hunt shx*.php after patching
RELATED CVES
n/a Related
An earlier flaw in the same proxy.php script. Its fix does not close CVE-2026-110447.
AssessedThe fix shipped five weeks before the advisory, so patch-only monitoring missed it. Disabling the app does not help, and the update does not remove a dropped shell.
09 · VALIDATION

Confirm remediation

The update alone is not a verdict. Each server should end with a result: patched and clean, patched with findings, or exposed.

01
Check the app and its version
Run from the Nextcloud directory.
sudo -u www-data php occ app:list | grep -A1 richdocumentscode
02
Update or remove it
Disabling is not enough.
sudo -u www-data php occ app:update richdocumentscode
sudo -u www-data php occ app:remove richdocumentscode
03
Hunt for web shells
Attackers drop files named shx followed by random characters.
find /var/www/nextcloud -name 'shx*.php'
sudo -u www-data php occ integrity:check-app richdocumentscode
04
Search logs for the attack
Look for proxy.php requests carrying shell characters.
grep -E 'proxy\.php\?status.*(\$\(|\$\{IFS\}|%2e%2e)' /var/log/nginx/access.log*
05
Check for escalation attempts
Failed sudo by the web server account is a sign of escalation.
grep 'www-data' /var/log/auth.log | grep sudo
10 · EXPOSURE SELF-ASSESSMENT

Am I exposed?

CVE-2026-110447
01Does any Nextcloud server have the Built-in CODE Server app (richdocumentscode) below 26.4.303, even disabled?
02Is Nextcloud reachable from outside, so proxy.php could be reached without a login?
03Has the app been upgraded to 26.4.303 or later, or removed, on every server?
04Have you hunted the server for shx*.php and other unexpected PHP files?
ANSWER TO SEE A VERDICT
Pick yes, no or not sure for each question.
11 · REFERENCES AND REVISION HISTORY
References
›Collabora advisory and GitHub issue for CVE-2026-110447
›CISA Known Exploited Vulnerabilities catalog
›BleepingComputer: Hackers exploit Collabora RCE to backdoor Nextcloud
›The Hacker News: Hackers backdoor Nextcloud servers
Revision history
1.0Oct 28, 2026Initial publication.

This advisory will be updated as exploitation activity or vendor guidance changes.

12 · FAQ
Is CVE-2026-110447 being exploited?

Yes. Attacks began on September 10, 2026, and CISA added it to the KEV catalog on October 23.

Which version fixes it?

richdocumentscode 26.4.303 or later. It needs Nextcloud 30 or later.

Does disabling the app protect me?

No. Collabora says you must upgrade or remove it.

Does updating remove a web shell?

No. Search for shx files and other unexpected PHP after you update.

VALIDATE YOUR EXPOSURE

Prove your collaboration servers are clean

Hayrok maps your collaboration servers, confirms the app version, and checks whether the server will start the local service from attacker-controlled input. Every result lands in Evidence Fabric.

Book a technical session → Apply to the Design Partner Program
At Hayrok Labs we question everything and Validate what matters.