TL;DR
CVE-2026-110447 is a critical OS command injection vulnerability (CWE-78) in the richdocumentscode Nextcloud app, which bundles Collabora Online's built-in CODE Server. The vulnerability affects versions before 26.4.303 and carries a CVSS v3.1 score of 9.8 (Critical).
The flaw resides in proxy.php and occurs when the CODE Server is not running, such as immediately after a restart. An attacker can exploit this condition to achieve unauthenticated remote code execution (RCE), potentially compromising the underlying server's confidentiality, integrity, and availability.
The vulnerability has been exploited in the wild and added to CISA's Known Exploited Vulnerabilities (KEV) Catalog. Administrators should upgrade the richdocumentscode app to version 26.4.303 or later and investigate potentially compromised systems. Note that standalone Collabora Online server deployments are not affected; the vulnerability specifically impacts the built-in CODE Server deployment within Nextcloud.
Affected Software & Versions
- Software: Nextcloud
richdocumentscodeapp (built-in Collabora Online CODE Server) - Affected versions: Versions before
26.4.303(GHSA-g3vx-3m76-fghh) - Fixed version:
26.4.303and later - Deployment scope: Nextcloud deployments using the built-in CODE Server
- Not affected: Standalone Collabora Online server deployments
What the Incident Report Adds
GitHub issue #354 is valuable because it documents observed exploitation, not just the vulnerability description. The reporter said the affected installations were running richdocumentscode 26.4.302 and described requests targeting: /apps/richdocumentscode/proxy.php?status
The requests combined encoded path traversal, shell command substitution, ${IFS} whitespace obfuscation, and a Base64-decoded shell payload. The reported result was the creation of PHP web shells with names such as shx*.php. A recovered sample accepted a command through the c query parameter and executed it with shell_exec(), giving the attacker command execution in the web-server/PHP process context. The full exploit request is omitted here; the indicators below are sufficient for defensive hunting.
The reporter described multiple affected Nextcloud installations. On one system, the web shell was subsequently used to search for password databases and cryptocurrency wallet or keystore artifacts. The reporter did not find explicit evidence in the reviewed HTTP requests that files had been archived, uploaded, or exfiltrated. That limitation does not prove no data was accessed: a web shell can read or modify anything permitted to the web-server account.
Indicators of Compromise (IOCs)
Use these as hunting leads, not as a complete detection signature. IP addresses and callback infrastructure can change, and legitimate logs may contain some individual strings.
| Type | Reported indicator |
|---|---|
| Target endpoint | /apps/richdocumentscode/proxy.php?status |
| Suspicious path pattern | Requests containing encoded traversal such as %2e%2e near richdocumentscode/proxy.php |
| Shell-injection markers | %24%28, $(, or ${IFS} combined with shell commands |
| Base64-to-shell pattern | base64 decoding piped into sh |
| Web-shell filenames | shx*.php, including shxa35d0.php, shx5cf91.php, shxd33ce.php, and shxf4645.php |
| Callback indicator reported in the incident | webhook.site |
| Source IP reported in the incident | 139.28.18.122 |
| SHA-256 of one recovered sample | 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562 |
Treat the IP and callback domain as incident-specific indicators from the public report, not proof that every exploitation attempt uses the same infrastructure.
Why Disabling the App Is Not Enough
Collabora's advisory explicitly states that disabling the app does not eliminate the exposure: the vulnerable app must be upgraded to 26.4.303 or later, or removed. The issue thread also records a maintainer confirming that 26.4.303 should be safe. The maintainer warned that lingering shx*.php files should be removed during cleanup. If exploitation is suspected, do not rely on upgrading alone investigate the host and treat accessible secrets and application data as potentially exposed.
Mitigation & Remediation
The recommended remediation for CVE-2026-110447 is to upgrade the richdocumentscode app to version 26.4.303 or later. Since this vulnerability has been exploited in the wild, affected Nextcloud instances should be prioritized for immediate remediation.
- Upgrade the Vulnerable App: Update the built-in Collabora Online CODE Server app to a patched version. The vulnerability affects versions before
26.4.303.
Administrators should verify the installed version and confirm that the upgrade completed successfully.
- Remove the App if Patching Is Not Possible: If the vulnerable app cannot be upgraded immediately, remove the built-in CODE Server app until a patched version can be deployed.
Important: Simply disabling the app may not eliminate the exposure. Remove the vulnerable app or upgrade it to a fixed version.
- Investigate Potential Compromise: Because exploitation has been observed in the wild, patching alone is insufficient for systems that may already have been compromised.
Administrators should:
- Review web server access logs for suspicious requests targeting
richdocumentscode/proxy.php. - Inspect the application directory for unexpected or recently created PHP files.
- Check for suspicious processes, persistence mechanisms, and outbound network connections.
- Investigate any indicators of unauthorized command execution.
- Rotate credentials and secrets that may have been exposed if compromise is confirmed or suspected.
- Verify the Remediation: After updating or removing the app, confirm that the installed version is no longer vulnerable and that the deployment operates as expected. If evidence of exploitation is discovered, treat the affected host as potentially compromised and follow an appropriate incident response and recovery process.
