Attackers backdoor Nextcloud servers via flaw in Collabora's built-in CODE app

Attackers have been exploiting a critical flaw in the optional Nextcloud app "Collabora Online - Built-in CODE Server" to plant PHP web shells on Nextcloud servers since September, according to The Hacker News. The unauthenticated command injection, now tracked as CVE-2026-110447 under advisory GHSA-g3vx-3m76-fghh, was quietly fixed on September 11 but only received a CVE and public advisory on October 14, leaving many administrators unaware they needed to act.

What happened

The Hacker News reported that three administrators raised the issue on GitHub. The first said several Nextcloud servers they host, all running version 26.4.302 of the richdocumentscode app, had been compromised. Another found the shell when Nextcloud's integrity check flagged a new PHP file, while a third learned of the break-in from failed sudo alert emails. The first logged attack took place on September 10, and Collabora's advisory says the flaw was exploited in the wild in September and October 2026. The number of affected servers is unknown.

Technical details

According to the outlet, the app's proxy.php script placed request text, including the path, inside a double-quoted bash command, so a command hidden in the path ran as the web server user. The attack works only when the app's local document server is not running, for example during a restart, upgrade or crash. A separate command injection in the same script, CVE-2025-66208, was disclosed in December 2025, and its fix does not prevent this issue.

In the reviewed attacks, requests to proxy.php?status decoded a one-line PHP web shell into the app folder. On one server the attacker searched for password databases and cryptocurrency wallets such as *.kdbx and wallet.dat. The reporter saw no commands that copied files out and no evidence of root access, but advised treating anything the web server account could read as potentially exposed.

Indicators published in the report include the shell's SHA-256 hash 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562, file names such as shxa35d0.php and shrf4645.php in apps/richdocumentscode/, and the IP addresses 139.28[.]18[.]122 and 89.38[.]98[.]50.

Who is affected

All versions of richdocumentscode before 26.4.303 are vulnerable. Standalone Collabora Online servers and installations using only the Nextcloud Office (richdocuments) app without the built-in server are not affected. The Hacker News noted that fixed versions require Nextcloud 30 or later, while end-of-life Nextcloud 29 and older are still served an affected version.

What to do

Update richdocumentscode to 26.4.303 or later, or remove the app; Collabora's advisory says disabling it is not sufficient. Some administrators reported that version 26.4.402 fails to open documents and reverted to 26.4.303. Teams should delete any shx*.php files, review access logs back to at least September 10 for proxy.php?status requests containing %2e%2e, $( or ${IFS}, check for sudo attempts by the web server account and rotate credentials it could read.