.jpg?w=1024)
Nextcloud administrators have more than a patch to install. Hackers are exploiting a critical vulnerability in Collabora’s built-in CODE Server app to execute commands and plant PHP web shells on vulnerable servers.
Tracked as CVE-2026-110447, the command-injection flaw affects versions of the richdocumentscode app before 26.4.303. Exploitation is possible when the local document server is not running, including during a restart, upgrade, or crash. Attacks have been observed since Sept. 10, making compromise checks important even for organizations that have already updated.
Collabora flaw exposes a specific Nextcloud configuration
The affected component is Collabora Online - Built-in CODE Server, an optional Nextcloud app that provides document editing without requiring a separate Collabora server. Nextcloud describes it as an easy-to-install option for personal use or small teams, although it lacks some of the performance and scalability features of a standalone deployment.
Collabora’s security advisory said the flaw can let an unauthenticated attacker execute operating system commands with the privileges of the web server account when the local CODE server is offline. The vendor fixed the issue in version 26.4.303 and warned that disabling the app is not sufficient. Administrators must update it or remove it. Standalone Collabora Online servers are not affected.
Attackers planted web shells and searched for sensitive files
The Hacker News reported that multiple administrators found evidence of exploitation, including PHP web shells placed in the Collabora app directory. Attackers used the access to search for files associated with password managers, cryptocurrency wallets, and other sensitive data. The reports reviewed by the publication did not show the attackers gaining root access.
The same reporting identified shx*.php files among the indicators administrators should investigate, along with suspicious proxy.php?status requests, command-injection markers, and failed sudo attempts involving the web server account.
In the original GitHub incident report, an administrator documented payloads that attempted to send system information to webhook callbacks. The reviewed requests did not show commands to archive or upload files, so theft of credential stores or other sensitive files has not been established. However, files accessible to the compromised web server account should be treated as potentially exposed.
Security teams should check for compromise, not just patch
Installing the fixed version closes the vulnerable command path, but it does not remove a web shell that may already exist. Servers that used the built-in CODE app and restarted, upgraded, or crashed during the exploitation window should receive priority review.
Security teams should:
- Verify the installed app and version. Upgrade richdocumentscode to 26.4.303 or later, or remove it. Organizations running end-of-life Nextcloud 29 or earlier should upgrade Nextcloud or remove the app, as Collabora advises.
- Hunt for earlier exploitation. Inspect apps/richdocumentscode/ for unexpected PHP files, including names matching shx*.php and the reported file shrf4645.php. Review retained access logs back to at least Sept. 10 for requests targeting proxy.php?status with command-injection markers such as $( or ${IFS} in the request path. Investigate failed sudo attempts by the web server account.
- Assess exposed credentials and data. Determine what the web server account could read and rotate relevant credentials if signs of compromise are found.
Collabora’s release record dates version 26.4.303 to Sept. 11, while its security advisory was published Oct. 14. The gap is another reason for security teams to monitor vendor advisories and application updates alongside CVE feeds rather than waiting for a formal vulnerability identifier.
If evidence of compromise is found, preserve relevant logs and suspicious files, contain the affected server, and investigate the attacker’s access before restoring service. Assess potentially exposed credentials, rotate them from a trusted system, and determine whether the server needs rebuilding. Patching closes the vulnerability but does not remove existing attacker access.
Also read: We’ve also covered how Ahsay’s failed patch left two exploited backup flaws exposed, another case where attackers used server vulnerabilities to deploy web shells.