Attackers plant web shells on Nextcloud servers through Collabora's built-in CODE app
Attackers exploited CVE-2026-110447 in Nextcloud's built-in Collabora CODE app to plant web shells, with the first logged attack on September 10. Collabora says disabling the app does not help, so administrators must update to 26.4.303 or remove it.
The Watch · Security desk
Timeline: September 10, first logged attack. September 11, fix in 26.4.303. September 14, another attempt on an updated server, no new shell file. October 3, forum warning on which installs are not affected. October 14, Collabora advisory CVE-2026-110447.
- 2026First logged attack, per administrators' GitHub reports, claim 2
- 2026Collabora fixes the flaw in version 26.4.303, claim 4
- 2026Updated server logs another attempt; no new shell file appears, claim 19
- 2026Forum warning: installs without the built-in app not affected, claim 10
- 2026Collabora publishes advisory CVE-2026-110447, claim 5
| Date | Event | Claim |
|---|---|---|
| September 10, 2026 | First logged attack, per administrators' GitHub reports | 2 |
| September 11, 2026 | Collabora fixes the flaw in version 26.4.303 | 4 |
| September 14, 2026 | Updated server logs another attempt; no new shell file appears | 19 |
| October 3, 2026 | Forum warning: installs without the built-in app not affected | 10 |
| October 14, 2026 | Collabora publishes advisory CVE-2026-110447 | 5 |
What happened
- The command runs only while the app's local document server is down, such as during a restart, an upgrade or after a crash.
- In versions up to 26.4.302, proxy.php put request text, including the path, inside a double-quoted bash command, where the shell still runs anything written as $(...).
- One administrator's logs record two requests from a single IP address, each with a command hidden in the path: the first on September 10 at 19:51 and the second on September 11 at 09:56, both UTC+2.
- On one server the attacker then used the shell to search for credential stores and wallets, including *.kdbx, wallet.dat and keystore.json files.
- Two other administrators reported the same, one after Nextcloud's integrity check flagged a new PHP file and one after emails about failed sudo attempts.
Why it matters
- decision The first call is inventory. Only installs with the built-in richdocumentscode app are in scope, and a separate Collabora server, in Docker, from a Linux package or hosted, takes an install out of it.
- constraint Nextcloud 29 and older cannot take the fix, which needs Nextcloud 30 or later, and the app store still serves them an affected version. Those operators have to upgrade Nextcloud or remove the app.
- cost Updating closes the entry. Removing a shell already written is a separate job, and mmeeks told users to delete any leftover shx*.php files.
- precedent proxy.php has now produced two command-injection flaws. The fix for CVE-2025-66208 did not prevent CVE-2026-110447.
Exploitability is high wherever the app is installed. The attacker needs no login, only a request whose path carries a $(...) command [11]. Collabora's advisory covers every version before 26.4.303 [9]. The timing condition has not stopped anyone: three administrators reported attacks on GitHub [2]. Nobody should count it as a defense.
The first logged attack was on September 10 [2], Collabora shipped 26.4.303 on September 11 [4], and a warning went up on the Nextcloud community forum on October 3 [10]. The CVE identifier did not arrive until October 14 [5], 33 days after the fix [23]. Anyone matching on CVE numbers had no identifier to match until then. All of it is public: the GitHub reports, the forum post and the advisory. The attacker-side detail comes from administrators' reports as summarized by The Hacker News [2].
The affected script, plain PHP that the web server executes straight from the app's folder, loads none of Nextcloud's code [12]. We think that explains why switching the app off does not help: the entry point sits outside Nextcloud's own request handling. The app downloads a copy of Collabora Online Development Edition and runs it on the Nextcloud server itself, so Nextcloud Office can edit documents without a separate Collabora server [7]. Its store listing says it is "for local testing and non-production use" and "for personal use or for small teams" [8]. The report does not say how many installations run it.
Two source IP addresses appear in the reports. One sent the September 10 and 11 requests [14]. A second sent an attempt on September 14, against a server already updated to 26.4.303, with a payload of the same kind [19]. No new shell file appeared, and the CODE server that attempt started carried the attack text only in its startup options [19]. The output "looks scary but should be harmless," mmeeks said [20]. Two addresses over five days of attempts is a repeat pattern. The reports do not show whether one actor is behind both.
The first-stage command dropped a one-line PHP shell in the app's folder and attempted to post the output of uname -a from the server to a webhook.site address [15]. The administrator who reviewed the requests found no commands that archived, uploaded or copied out files, but wrote that anything the web server account can read must be treated as potentially exposed [17]. None of the three reports shows root access [18].
What to watch
- More shx*.php finds or new source IP addresses on the GitHub thread would show the spread beyond three reports.
- Any report of files archived, uploaded or copied out, or of root access, would move this from web-shell access to confirmed data loss.
- Whether the Nextcloud app store stops serving an affected version to Nextcloud 29 and older installs.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence78
- Adoption10
- Hype gap−10
- Incentives
- Insufficient
- Confidence76
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Attackers exploited a flaw in the optional Nextcloud app Collabora Online - Built-in CODE Server to plant web shells on Nextcloud servers.
- [2]
Three administrators reported the issue on GitHub, with the first logged attack on September 10.
- [3]
The flaw allows an unauthenticated request to run a command on the server, but only when the app's local document server is not running, such as during a restart or upgrade, or after a crash.
- [4]
Collabora fixed the flaw in version 26.4.303 on September 11.
- [5]
On October 14 Collabora published an advisory with the identifier CVE-2026-110447.
- [6]
"It is not sufficient to disable the app to avoid the problem; it must be upgraded to >= 26.4.303 or removed," Collabora said in the advisory.
- [7]
The app, package name richdocumentscode, downloads a copy of Collabora Online Development Edition and runs it on the Nextcloud server itself, so Nextcloud Office can edit documents without a separate Collabora server.
- [8]
The app's store listing says it is "for local testing and non-production use" and "for personal use or for small teams."
- [9]
Collabora's advisory covers every version before 26.4.303 and says standalone Collabora Online servers are not affected.
- [10]
A warning posted on the Nextcloud community forum on October 3 stated that an installation is not affected if it uses only the Nextcloud Office app (richdocuments) without the built-in app, whether its Collabora server runs in Docker, from a Linux package, or at a hosting provider.
- [11]
The app's proxy.php script starts the local CODE server whenever a request arrives and nothing is listening. In versions up to 26.4.302 it placed text from the request, including its path, inside a double-quoted bash command, where the shell still runs anything written as $(...), so a command hidden in the path ran as the web server user.
- [12]
The script is a plain PHP file that the web server runs directly from the app's folder and loads none of Nextcloud's code.
- [13]
The fixed versions require Nextcloud 30 or later. Nextcloud 29 and older are end of life, and the app store still serves them an affected version, so their users should upgrade Nextcloud or remove the app.
- [14]
Access logs from two of the first administrator's servers show requests at 19:51 on September 10 and 09:56 on September 11 (UTC+2), both from one IP address and both aimed at proxy.php?status with a shell command hidden in the request path. All of that administrator's servers ran version 26.4.302.
- [15]
The command decoded a one-line PHP web shell into the app's folder and tried to send the server's uname -a output to a webhook.site address.
- [16]
On one server, the attacker used the shell to search for credential stores and cryptocurrency wallets, including *.kdbx, wallet.dat and keystore.json files.
- [17]
The reviewed requests showed no commands that archived, uploaded, or copied out files, but anything the web server account can read must be treated as potentially exposed, the administrator wrote.
- [18]
Two other administrators reported the same on their own instances: one found the shell when Nextcloud's integrity check flagged a new PHP file, and the other learned of the break-in from emails about failed sudo attempts. None of the reports show the attacker gaining root access.
- [19]
After one administrator updated to 26.4.303, that server logged another attempt on September 14 from a second IP address with a payload of the same kind. The CODE server it started carried the attack text in its startup options, but no new shell file appeared.
- [20]
mmeeks, who answered for the project in the thread, said the output "looks scary but should be harmless," and told users to update.
- [21]
mmeeks told users to update and to remove any leftover shx*.php files.
- [22]
Collabora's fix for a separate command-injection flaw in the same script, CVE-2025-66208, disclosed last December, does not prevent this one.
- [23]
Collabora's CVE advisory (October 14) came 33 days after the September 11 fix.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
2 independent publishers whose own reporting we read for this story.
- dev.toNextcloud security flaw allows sensitive data to be stolen
1 article · October 14, 2026
- thehackernews.comHackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
1 article · October 14, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Web shell attacksFollow
- Command InjectionFollow
- Self-hosted software securityFollow