Nextcloud: Collabora's built-in CODE server is being exploited. Check it today

If you run Nextcloud with the built-in Collabora server, stop and check this today. CVE-2026-110447 is an OS command injection in the app Collabora Online - Built-in CODE Server (richdocumentscode). It needs no login and no user interaction, it is rated CVSS 4.0: 9.2, and attackers have been using it since September. CISA added it to its list of known exploited vulnerabilities on 23 October, with a deadline of 26 October for US federal agencies.

Who is affected

• Affected: the app richdocumentscode in every version before 26.4.303, even when the app is disabled.
• Not affected: a separate Collabora server (Docker, DEB/RPM packages), Nextcloud All-in-One, and Nextcloud Office (richdocuments) when it talks to a separate Collabora server. Those two apps have similar names, so check which one you actually have.
• Nextcloud 29 and older: the newest app version you can install there is 26.4.104, which is vulnerable. You need to remove the app or upgrade Nextcloud.

How the attack works, in short

The app has a script, proxy.php, that starts the bundled Collabora server when a request arrives and nothing is listening. In the vulnerable versions the request path was put inside a double-quoted shell command. The shell expands $(...) there, so a command hidden in the path runs as the web server user. The attack works while the local CODE server is down, for example after a restart, an upgrade or a crash.

Attackers dropped a one-line PHP web shell into the app folder and then looked for password databases, password manager files and cryptocurrency wallets. The first logged attack was on 10 September, one day before the fixed version was released. The CVE and the advisory only came on 14 October, more than four weeks after the fix. That is the real lesson: waiting for a security alert would have been too late.

Check in five minutes

cd /var/www/nextcloud
sudo -u www-data php occ app:list | grep -i richdocuments
sudo -u www-data php occ integrity:check-app richdocumentscode
find apps/richdocumentscode -name 'shx*.php'
find apps/richdocumentscode -name '*.php' -exec sha256sum {} + | grep 4b9fbd0663fbfd60

The first line shows whether you have richdocumentscode (the built-in server, vulnerable) and which version. The second runs Nextcloud's integrity check for the app. The last two look for the web shells reported so far: files named shx….php and the hash of the one-line shell.

Then the logs, back to at least 10 September (rotated logs included):

zgrep -hE 'richdocumentscode/proxy\.php' /var/log/nginx/access.log* \
  | grep -E '\$\(|%24%28|IFS|base64|%2e%2e'
zgrep -hE '139\.28\.18\.122|89\.38\.98\.50' /var/log/nginx/access.log*

Every hit in the first command is a request that tried to inject something. The two IP addresses are those named in the public reports. Logs rotate, so no hit does not prove you were not attacked earlier.

Fix it

• Update: sudo -u www-data php occ app:update richdocumentscode. Fixed versions are 26.4.303, 26.4.402 and 26.4.502 (Nextcloud 30 and newer). Some admins reported start problems with 26.4.402 in mid-October and went back to 26.4.303.
• Or remove it if you do not use the built-in server: sudo -u www-data php occ app:remove richdocumentscode. Disabling is not enough, Collabora says so explicitly. For editing documents, a separate Collabora server is the cleaner setup anyway.
• An update does not remove a web shell. Run the checks above after updating, not only before.

If you find a web shell

Treat it as a compromise. The web server user can read config.php, so the database password, the instance secret and any stored credentials must be considered exposed. My advice: take the server out of reach, restore from a clean backup if you are unsure how far it went, rotate the database password and the secrets in config.php, and have users change passwords and app passwords. In the reports no root access was seen, but that is no guarantee.

A few tips

• Remove optional apps you do not use. Every app is attack surface, and this one runs a server process of its own.
• Separate Collabora server or All-in-One keep the document server away from your Nextcloud files.
• Update apps on a schedule, not when a headline appears. The fix existed for more than a month before the advisory.
• Keep an inventory: which Nextcloud apps run where. It makes a day like today a five-minute job.

Sources: BleepingComputer, The Hacker News and eSecurityPlanet. More Nextcloud commands in the occ cheat sheet. For comparison: my post on the PHP emergency patch.

Originally published at daniele-michelin.com. More guides, free checks (SPF, TLS, headers) and an error-message lexicon: daniele-michelin.com/en/.