CYBUNKR

Nextcloud built-in Collabora flaw under attack

Published

Attackers are using CVE-2026-110447 in Nextcloud's Collabora Online Built-in CODE Server to plant web shells without logging in. CISA added it to its exploited list on 23 October. What to check and update.

If your Nextcloud runs the Collabora Online - Built-in CODE Server app (richdocumentscode) for editing documents, check it today. Collabora's advisory says a single request to the app's proxy.php can run an operating system command as the web server user, without logging in. It rates it critical, 9.2 out of 10 (CVSS v4.0). On 23 October CISA added it to its Known Exploited Vulnerabilities catalog.

What is affected

  • Built-in CODE Server before 26.4.303, the Nextcloud app that downloads and runs Collabora inside Nextcloud itself. Version 26.4.303 has the fix (released 11 September).
  • Only while the CODE server isn't running: Collabora says that means after a container restart, an upgrade or a crash, so a server that looks fine most of the time can still be hit.
  • Not standalone Collabora Online servers. Collabora says only the built-in deployment is affected.

What has been seen so far

A snapshot from 25 October:

  • The CVE record says the flaw was exploited in the wild in September and October 2026.
  • An admin hosting several Nextcloud servers reported successful attacks from 10 September. The attacker dropped PHP web shells named like shx*.php in the app's folder, and on one server used them to hunt for password manager files and cryptocurrency wallets.
  • Collabora published its advisory on 14 October, and CISA listed the flaw as known exploited on 23 October.

What to do

  • Update the app to 26.4.303 or later, or remove it. Collabora says disabling it isn't enough.
  • On Nextcloud 29 or older (no longer supported), upgrade Nextcloud or remove the app.
  • Look for web shells: check apps/richdocumentscode/ for shx*.php files and web logs for requests to proxy.php containing $( or %2e%2e. Collabora asks admins to remove any lingering shx*.php files; the issue also lists the IP addresses and file hash seen.
  • If you find one, treat the server as compromised: the shell runs as the web server user, so assume anything that account can read, including stored files and application secrets, may have been seen or changed. Rotate those credentials and check from 10 September onwards.
  • Longer term, consider a standalone Collabora Online server, which Collabora says isn't affected.

How we can help

Found a web shell, or not sure what you're looking at? Our Incident Response service can help, or get in touch. Penetration Testing finds exposed and unpatched systems like this before attackers do.

Sources