Affected Systems

Collabora Online - Built-in CODE Server (richdocumentscode) versions before 26.4.303, used with Nextcloud. Standalone Collabora Online servers not affected. Nextcloud instances using only richdocuments app (external Collabora server) not affected. Vulnerability exploitable only when local CODE server is down (restart, upgrade, crash).

Exploitation Status

Active exploitation confirmed. First attack September 10, 2026. Multiple Nextcloud servers compromised with web shells planted. Attackers searched for credential stores, cryptocurrency wallets, and sensitive files. CVE-2026-110447 assigned. Additional attack attempt observed September 14 after initial disclosure.

Business Impact

Unauthenticated remote code execution with web server privileges. Attackers planted PHP web shells and exfiltrated data accessible to web server account, including potential credential stores (KeePass, Bitwarden, 1Password) and cryptocurrency wallets. Command injection via proxy.php script bypasses Nextcloud authentication entirely. Disabling the app does not mitigate—file remains executable. Nextcloud 29 and older cannot install fixed version and remain vulnerable via app store.

Urgency

🔴 Immediate

Recommended Actions

  • Update Collabora Online - Built-in CODE Server (richdocumentscode) to version 26.4.303 or later, or completely remove the app. Disabling in Nextcloud UI does not prevent exploitation.
  • Search for web shells starting in apps/richdocumentscode/ directory, specifically files matching pattern shx*.php, and delete any found.
  • Review web server access logs from September 10 onward for requests to proxy.php?status containing %2e%2e, $(, or ${IFS} in the path. Check system logs for sudo attempts by web server user (www-data, apache, nginx).
  • Treat all files readable by web server account as potentially compromised, including *.kdbx, wallet.dat, keystore.json, and credential manager databases. Rotate credentials and secrets accordingly.
  • If running Nextcloud 29 or older (end of life), upgrade Nextcloud to version 30+ to receive patched app version, or remove richdocumentscode app entirely.

---

# Threat Actor Context

Actor Profile

The threat actor behind this campaign remains unattributed. Activity was first observed on September 10, 2026, with attacks originating from at least two distinct IP addresses. The actor demonstrated opportunistic behavior, targeting a narrow exploitation window when the Collabora Online Built-in CODE Server was not running. Motivation appears financially driven, with post-exploitation activity focused on credential stores and cryptocurrency wallets including Bitwarden, 1Password, Bitcoin, Electrum, Monero, and Ethereum assets. The actor deployed simple PHP web shells and conducted reconnaissance for high-value data but showed no evidence of privilege escalation to root or sophisticated persistence mechanisms.

TTPs (Tactics, Techniques, Procedures)

Initial Access: Exploitation of Public-Facing Application (T1190) via CVE-2026-110447, a command injection vulnerability in Collabora Online Built-in CODE Server proxy.php script affecting versions prior to 26.4.303. Execution: Command and Scripting Interpreter (T1059) using bash command injection through malformed HTTP requests containing shell metacharacters ($(...) syntax) in the request path. Persistence: Server Software Component - Web Shell (T1505.003) by deploying one-line PHP web shells (shx*.php pattern) into the richdocumentscode app directory. Discovery: File and Directory Discovery (T1083) searching for credential stores (*.kdbx, wallet.dat, keystore.json) and cryptocurrency wallet directories. Collection: Data from Local System (T1005) targeting password managers and cryptocurrency assets. The vulnerability only exploited during server downtime (restart, upgrade, crash), requiring precise timing.

Targets & Patterns

Targets were organizations running Nextcloud servers with the optional Collabora Online - Built-in CODE Server app (richdocumentscode package) installed. The app is marketed for "local testing and non-production use" and "personal use or for small teams," suggesting targets were likely small to medium organizations, home labs, or development environments rather than enterprise deployments with dedicated Collabora servers. Affected sectors include software development and collaboration tool users. Geographic distribution is unknown, though reported incidents used UTC+2 timestamps. The targeting appears opportunistic rather than strategic—attackers scanned for vulnerable endpoints rather than selecting specific organizations. The narrow exploitation window (only when CODE server is down) suggests automated scanning for vulnerable instances combined with repeated exploitation attempts. Standalone Collabora Online servers and installations using only the Nextcloud Office app without the built-in component were not affected.

Historical Context

This vulnerability (CVE-2026-110447) is the second command injection flaw discovered in the same proxy.php script within ten months. A previous command injection vulnerability, CVE-2025-66208, was disclosed in December 2025, but its fix did not prevent the current exploit. The recurrence of command injection flaws in the same component suggests systemic input validation weaknesses in the proxy.php implementation. The first documented exploitation occurred on September 10, 2026, one day before Collabora released version 26.4.303 on September 11. Collabora did not publish a formal advisory until October 14, 2026, over one month after the initial fix, during which time the vulnerability remained actively exploited. A community warning appeared on the Nextcloud forum on October 3. Version 26.4.402 released September 24 attempted further hardening but introduced stability issues, forcing administrators to revert to 26.4.303. The campaign represents opportunistic exploitation of a zero-day vulnerability in a niche deployment mode affecting only the Development Edition built-in server configuration.

Defensive Recommendations

  • Immediately update Collabora Online - Built-in CODE Server (richdocumentscode) to version 26.4.303 or later, or remove the app entirely. Disabling the app in Nextcloud does not mitigate the vulnerability as proxy.php remains executable.
  • Hunt for web shell artifacts by searching for shx*.php files starting in apps/richdocumentscode/ directory and subdirectories. Delete any discovered files and investigate associated access logs for the timeframe of file creation.
  • Review web server access logs from September 10, 2026 onward for requests to proxy.php?status containing URL-encoded command injection indicators: %2e%2e (path traversal), $( or ${IFS} (bash command substitution). Correlate suspicious requests with system logs for unauthorized sudo attempts by the web server user account.
  • Treat all files readable by the web server account as potentially compromised if exploitation indicators are found. Prioritize review of credential stores (*.kdbx, Bitwarden, 1Password data), cryptocurrency wallets (wallet.dat, keystore.json, .bitcoin, .electrum, .monero, .ethereum directories), and sensitive configuration files.
  • Implement network-based detection for T1505.003 web shell activity by monitoring for new PHP files in application directories and unusual outbound connections from web server processes. Enable Nextcloud's integrity checking feature to alert on unauthorized file modifications in app folders.