Nextcloud Collabora Vulnerability Exploited

A Nextcloud Collabora vulnerability in the optional Built-in CODE Server app has let attackers plant web shells on Nextcloud servers since September 10. Collabora fixed it on September 11 without a security notice, and the CVE (CVE-2026-110447) followed only on October 14. Disabling the app does not close the hole: update it or remove it.

What Happened

The app, published as richdocumentscode, runs a local copy of Collabora Online Development Edition so that Nextcloud Office works without a separate document server. Its proxy.php script starts that local server whenever a request arrives and nothing is listening. In versions up to 26.4.302, the script put text from the request, including its path, inside a double-quoted bash command, so a command hidden in the path ran as the web server user. The attack works only while the local document server is down, for example during a restart, upgrade or crash. The Nextcloud community cites a severity of 9.2 out of 10.

The first logged attack came on September 10. Three administrators reported web shells on GitHub. The attackers dropped a one-line PHP web shell, and on one server they used it to search for password-manager files and crypto wallets. The reviewed requests show no file uploads, and no report shows root access. The fix was committed on August 20 as a routine cleanup, shipped as version 26.4.303 on September 11 with release notes that mention only the bundled CODE build, and flagged by a Nextcloud community member on October 3 as already exploited. Collabora published the advisory and CVE on October 14, 33 days after the fix. The number of compromised servers is unknown.

Why It Matters

Not every Nextcloud is affected. Standalone Collabora Online, Docker and package installs, hosted Collabora and Nextcloud Office without the built-in app are not. The app store lists it for local testing and small teams, which is exactly who runs it in production. Assumption: self-hosted Nextcloud is common in DACH small businesses, public bodies and schools. As of October 19, we found no BSI warning for this flaw and know of no German victims.

The governance problem with this Nextcloud Collabora vulnerability is the gap between fix and notice. A fix with no security label for 33 days gives defenders nothing to act on while attackers already have the details. We saw the same shape with Zammad on October 6. Nextcloud 29 and older cannot install the fix, and the app store still serves them an affected version.

What You Should Do Now

1. Check and update. In the Nextcloud app list, look for “Collabora Online – Built-in CODE Server” (richdocumentscode). Below 26.4.303, update or remove it; disabling it in Nextcloud is not enough, Collabora says. The fixed versions need Nextcloud 30 or later, so on 29 or older upgrade Nextcloud or remove the app. Version 26.4.402 reportedly fails on some setups; the advisory names 26.4.303.
2. Hunt for web shells. Run occ integrity:check-app richdocumentscode and look for unexpected PHP files, starting in apps/richdocumentscode. Reported names vary (shx*.php, shrf*.php and others), so do not rely on the name. Keep a copy for forensics before deleting it.
3. Check logs back to September 10. Search the web server access log for requests to proxy.php?status that contain %2e%2e, $( or ${IFS} in the path, and look for sudo attempts by the web server account.
4. If you find a shell, treat everything the web server account can read as exposed. Rotate the database password, secrets in the Nextcloud configuration, app passwords and anything else stored on the host, including password-manager and wallet files. Consider moving to a standalone Collabora server, which is not affected.

DIESEC Perspective

A vendor’s release notes are not an alert channel. Subscribe to advisory feeds for every app on a self-hosted collaboration server, and treat optional components marked “for testing” as production attack surface the moment they listen on the web.

Not sure whether your Nextcloud runs the built-in Collabora app or was already hit? Contact DIESEC for a rapid exposure check and web shell hunt on your self-hosted collaboration servers.

Sources: The Hacker News | Collabora advisory | Nextcloud Community | BleepingComputer
Published: 2026-10-21 | Category: Vulnerabilities & Patches | ~4 min read