Collabora Online CVE-2026-110447: Pre-Authentication OS Command Injection in Nextcloud Built-in CODE Server

1. Basic Information

• Advisory: Unauthenticated OS command injection in the richdocumentscode proxy
• Vendor: Collabora Online
• Published: 2026-10-14
• Updated: None
• Source: Collabora Online
• Related Source: Administrator Report and Developer Guidance: richdocumentscode #354
• Associated Malware: None
• Associated Threat Group: None
• Associated CVE: CVE-2026-110447
• Related Products: Nextcloud Built-in CODE Server (richdocumentscode) prior to 26.4.303, Nextcloud Server
• Severity: Critical

This vulnerability allows unauthenticated remote attackers to execute OS commands on internet-facing Nextcloud instances, and active exploitation has been confirmed. Disabling the application is insufficient; updating to version 26.4.303 or later or removing the application is required.

2. Executive Summary

An unauthenticated OS command injection vulnerability exists in proxy.php within the optional Nextcloud application "Built-in CODE Server," allowing arbitrary command execution when connecting to a stopped CODE server. Active exploitation and the deployment of PHP web shells have been reported starting September 10, 2026.

3. Attack Flow

Path 1: Confirmed Pre-Authentication Exploitation Vector

1. An attacker sends a crafted request to proxy.php in richdocumentscode on Nextcloud.
2. The input reaches shell commands when the CODE server is stopped, executing OS commands without authentication.
3. A PHP web shell is deployed to maintain the ability to execute additional commands continuously.
4. Files related to password databases, password managers, and cryptocurrency wallets are searched.

4. Attacker Position and Execution Location

• An unauthenticated remote attacker with network access to Nextcloud over the internet.

5. Victim and Administrator Perspective

• Victims and Users: No explicit warnings may appear during normal Nextcloud usage.
• Administrators: Appears as anomalous requests to proxy.php, unknown PHP files under the Nextcloud directory, shell execution spawned by the web server child process, and credential reconnaissance activity.

6. Success and Failure Conditions

Success Conditions

• The richdocumentscode application version is prior to 26.4.303.
• The CODE server is stopped, and the vulnerable proxy path is reachable.

Failure Conditions and Countermeasures

• Update to version 26.4.303 or later, or remove the application from the file system.
• Inference: If applying temporary access restrictions, target the vulnerable application paths including proxy.php rather than just the administrative interface. Web server privileges and the placement of sensitive information serve as mitigation measures and do not replace updates or removal.

7. Impact of Successful Exploitation

• Arbitrary OS commands executed with web server privileges.
• Persistent remote access via PHP web shells and reconnaissance for credentials and wallet information.

8. Observable Logs

The following are candidates for investigation within your organization. Availability depends on products, permissions, log settings, and retention periods, and the absence of records does not prove the absence of a compromise.

• Email: No email vectors specific to this issue have been identified.
• Proxy / SWG / DNS: Inference: Unusual parameters or rapid repeated requests directed at proxy.php.
• Endpoint / EDR: Inference: Records of shells or utilities spawned from web server processes, and unknown PHP files created under the Nextcloud directory.
• Identity / IdP: Inference: Nextcloud sessions following the compromise timestamp, administrator logins, and the use of stored credentials.
• SaaS / Cloud: Inference: Nextcloud audit logs, application update history, and file access history.
• Network: Inference: Outbound connections or downloads from the Nextcloud host to unknown destinations.

9. Determining Attack Success

Confirmed in Public Information

• Subsequent Compromise Confirmed: Public Information: The affected administrator in issue #354 reported the creation of a PHP web shell and subsequent reconnaissance of credentials and wallets from it. This does not substantiate successful data exfiltration or root privilege acquisition. Scope: Multiple Nextcloud environments reported by the affected administrator. Subsequent actions under web server privileges.

Separate contact, execution, persistence, data collection, and exfiltration; do not infer unconfirmed success from a single alert.

10. Investigation Playbook

• Investigation Starting Point: Versions prior to 26.4.303, anomalous requests to proxy.php, and unknown PHP files.
• Initial Verification: Determine whether the instance uses the Built-in CODE Server app or an external CODE server, then check the version, stop/restart timestamps, and exposure scope.
• Endpoint / Server Investigation: Preserve web roots, process trees, shell history, temporary directories, and web shell IOCs.
• Authentication / Cloud Investigation: Review usage history for Nextcloud administrators, databases, password managers, and service credentials.
• Subsequent Actions: Track web shell commands, secret access, outbound communications, and lateral movement.
• Containment: Isolate the host, preserve evidence, update or remove the application, remove web shells, and rotate credentials.
• Judgment Classification: Evaluate scanning, command execution, web shell deployment, secret access, and outbound transmission separately.

11. Defense and Detection Ideas

• Single Event: Prioritize events where shells are spawned from web server processes.
• Time-Series Correlation: Correlate proxy.php requests -> shell execution -> PHP file creation -> outbound communications.
• Threat Hunting: Search all Nextcloud instances for richdocumentscode versions and unknown PHP files.
• Log Limitations: Web access logs alone cannot verify command results or file access; host-side telemetry is required.
• Priority Action: Prioritize updating to 26.4.303 or later, or removing the application.

Inference: Apply access restrictions leading up to the update to paths including proxy.php, and combine this with the segregation of sensitive information.

12. Facts / Inference / Hypothesis

Facts

• CVE-2026-110447 is an OS command injection vulnerability in proxy.php of richdocumentscode, with a CVSS score of 9.2 and CWE-78.
• It affects the optional Built-in CODE Server application used in Nextcloud. Standalone, Docker, RPM/DEB versions of Collabora Online and Nextcloud AIO CODE servers are not affected.
• The attack succeeds when proxy-mediated connections occur while the CODE server is stopped.
• An affected administrator reported logs from September 10-11, 2026, the creation of a PHP web shell, and the exploration of credential and wallet files. Public requests do not show commands indicating file archiving, uploading, or exfiltration.
• It was patched in version 26.4.303. Because Nextcloud 29 and earlier have reached End of Life (EOL), application removal or migration to a supported version is required.
• Simply disabling the application leaves files behind, so official guidance requires updating or removal.

Inference

• Following web shell deployment, attackers may proceed to subsequent reconnaissance using Nextcloud privileges, settings, and external connection details. The scope of individual damage has not been publicly disclosed.

Hypothesis

No additional hypotheses. Unverified items are listed in "Open Questions and Additional Investigation."

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1190	Exploit Public-Facing Application	high	Exploits the richdocumentscode proxy on internet-facing Nextcloud instances prior to authentication. Source
T1505.003	Server Software Component: Web Shell	high	Deployment of PHP web shells was reported in active exploitation. Source

14. Open Questions and Additional Investigation

• Verification of threat actors, total number of affected organizations, actually exfiltrated information, and additional reports concerning ransomware remains incomplete.

15. Impact on SOCs and Organizations

Stopping or disabling an application is not equivalent to rendering vulnerable files unreachable. Organizations that have deployed the Built-in CODE Server should also evaluate periods of stoppage, restarts, and outages, verify application updates or removal, and assess the impact of residual web shells and secrets readable by the web server.

16. Summary by Role

• For SOCs: Review Nextcloud web access, proxy.php, PHP file creation, web shell execution, and credential reconnaissance in chronological order.
• For Administrators: Update richdocumentscode to 26.4.303 or later, or remove it. Do not rely solely on disabling the app.
• For Users: No user action is required. Follow any password change or session re-authentication instructions from administrators.