The U.S. Cybersecurity and Infrastructure Security Agency has put an actively exploited command-injection flaw in Collabora Online’s Built-in CODE Server on its Known Exploited Vulnerabilities catalog, giving federal civilian agencies until October 26 to remediate it.
CVE-2026-110447 affects the richdocumentscode app used to run a bundled Collabora document server inside Nextcloud. A remote attacker does not need an account or user interaction. When the bundled server is stopped, including during a restart, upgrade or crash, a crafted request to proxy.php can execute operating-system commands as the web server user.
The fix is available in Built-in CODE Server 26.4.303. Installing that version or later closes the vulnerable path, but administrators also need to check whether attackers arrived before the update. Public incident reports describe PHP web shells left inside the app directory and follow-on searches for credential stores, password-manager files and cryptocurrency wallets.
Check the product name before patching
This is not a flaw in every Collabora Online installation. The Collabora security advisory defines the affected component narrowly:
- Affected: Nextcloud servers with the optional Collabora Online – Built-in CODE Server app, package name
richdocumentscode, below version 26.4.303. - Not affected by this CVE: standalone Collabora Online servers. Collabora also lists its hosted service, Docker images, RPM and DEB packages, and Nextcloud All-in-One images outside the affected Built-in CODE deployment.
- Older Nextcloud releases: version 26.4.303 requires Nextcloud 30 or later. Collabora tells operators of end-of-life Nextcloud 29 and older to upgrade Nextcloud or remove the Built-in CODE app.
The similar names matter. richdocuments is the Nextcloud Office integration app; richdocumentscode is the bundled document server implicated here. An inventory that only records “Collabora” or “Nextcloud Office” is not specific enough to determine exposure.
richdocumentscode on October 16. The body-match scan did not determine which installations were running a vulnerable version. Image: CensysWhy a restart-only attack condition still matters
The exploit path is available only while the Built-in CODE process is not running. That condition reduces the attack window, but it does not make an internet-facing server safe. Routine maintenance creates the required state: containers restart, packages update, processes crash and hosts reboot. Automated scanning can keep probing until one of those windows opens.
Disabling the app is not a sufficient mitigation. Nextcloud can continue serving files from a disabled app’s directory, and the vulnerable PHP proxy remains reachable. Collabora’s instructions are to upgrade richdocumentscode to at least 26.4.303 or remove the app entirely.
The vendor also warns that this is a different path from CVE-2025-66208. An installation that applied the earlier fix is not protected from CVE-2026-110447 unless the Built-in CODE package itself is at 26.4.303 or newer.
Patch, then verify the app
Run Nextcloud’s occ utility as the web server account from the Nextcloud installation directory. The exact account and PHP command vary by distribution and container image.
sudo -u www-data php occ app:list | grep -A2 -B2 richdocumentscode
sudo -u www-data php occ app:update richdocumentscode
sudo -u www-data php occ integrity:check-app richdocumentscodeConfirm that the installed version is 26.4.303 or later. If the server is on Nextcloud 29 or older and cannot be upgraded immediately, remove the Built-in CODE app rather than merely disabling it. Organizations that still need browser-based document editing can move to a supported Nextcloud release or a separate, supported Collabora deployment after completing incident-response checks.
Take a filesystem or volume snapshot before deleting suspicious files. That preserves evidence if the host is already compromised.
Hunt for the observed web shells
Administrator reports collected in Collabora’s public issue tracker show malicious requests targeting /apps/richdocumentscode/proxy.php?status. The requests used encoded path traversal, shell command substitution and whitespace obfuscation, then wrote PHP files whose names followed an shx*.php pattern.
Start with the app directory and web access logs. Adjust the paths for the installation:
find /var/www/nextcloud/apps/richdocumentscode -type f -name 'shx*.php' -ls
grep -RIE 'richdocumentscode/proxy\.php.*(%2e%2e|%24%28|webhook\.site)' \
/var/log/nginx /var/log/apache2 2>/dev/nullA clean filename search is not proof that the host escaped compromise. Attackers can choose different names, modify existing PHP files or remove their first-stage artifact. Review integrity-check failures, recently created or changed PHP files, web server child processes, outbound connections, cron entries, systemd units, temporary directories and authentication events around every restart or crash since September 10.
The first public incident report documented a recovered web shell with SHA-256 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562. It also recorded the source address 139.28.18.122 and callbacks to webhook.site. Treat those as useful historical clues, not a complete detection list.
Assume readable secrets may be exposed
The reported post-exploitation commands searched for KeePass databases, Bitwarden and 1Password artifacts, wallet.dat, and directories associated with Bitcoin, Electrum, Monero and Ethereum. Investigators did not see explicit exfiltration commands in the reviewed HTTP requests, but a shell running as the web server user can read or alter anything that account can access.
On a server with matching indicators, isolate the host and preserve evidence before cleaning it. Rotate the Nextcloud database password, mail credentials, object-storage keys, LDAP or directory bind credentials, API tokens and any other secret readable by the web process. Invalidate active sessions where appropriate, inspect Nextcloud administrator accounts and app passwords, and rebuild from a known-good image when the integrity of the installation cannot be established.
The patch existed before the advisory
Collabora released 26.4.303 on September 11, one day after the earliest malicious request in the public issue report. The formal advisory and CVE did not appear until October 14. CISA added the flaw to KEV on October 23.
That timeline is a reminder that app-store updates can carry security fixes before a scanner or CVE feed explains their urgency. Nextcloud operators should monitor application updates alongside operating-system and container patches, record exact app versions in asset inventory, and investigate unexplained process crashes or integrity warnings even when no advisory has arrived.
