Collabora’s built-in CODE server proxy.php lets attackers run commands on exposed Nextcloud instances

September 11, 2026. Collabora ships version 26.4.303 of its Built-in CODE Server app for Nextcloud, fixing a command injection in proxy.php. October 3, 2026. The Nextcloud help forum warns that the flaw is already being exploited and that users have found web shells on their instances. October 14, 2026. CVE-2026-110447 is published, rated CVSS 4.0 9.2 (critical), with no privileges required. The point that matters: the code execution is unauthenticated, and the patch does not make already-planted shells disappear.

A flaw in an optional component almost nobody watches

CVE-2026-110447 does not affect Nextcloud itself but an optional app in its ecosystem: Collabora Online Built-in CODE Server, packaged as richdocumentscode. This app has a peculiarity: it downloads and runs a full CODE server — Collabora’s office-editing engine, derived from LibreOffice — as a local AppImage, so that administrators avoid deploying a separate server.

The flaw is an OS command injection in proxy.php, the script that relays requests to the CODE server. The exploitation scenario is precise: when the CODE server is not running — typically right after a restart, before the AppImage has finished starting — an unauthenticated request to /apps/richdocumentscode/proxy.php?status can make the web server execute a system command. Operators reported PHP web shells written under the app’s directory tree, with names matching shx*.php.

The blind spot is exactly there: richdocumentscode is a convenience component — it bundles an entire office suite to spare a separate install — but it inherits the full attack surface of a document-editing server without anyone treating it as such. Installations that use the plain richdocuments connector without richdocumentscode, or that run Collabora via Docker, a distribution package, or a hosted service, are not affected. The problem is specific to the bundled AppImage.

A silent exploitation, and shells that survive the patch

The timeline tells of exploitation that preceded publicity. Operators reported compromises as early as September 2026, with web shells dropped after requests to the proxy.php?status endpoint. On October 3, the Nextcloud help forum confirmed the injection was already being exploited and that users had found shells. The CVE was only published on October 14 — while GitHub had tagged the fixed 26.4.303 release on September 11, meaning the window between the fix and public disclosure left attackers several weeks of visibility.

The practical consequence for remediation is severe: updating to 26.4.303 does not remove web shells that are already in place. An attacker who dropped shx*.php before the patch keeps access after the upgrade. Collabora’s guidance says it explicitly: upgrade and remove unexpected PHP files under the app directory. A compromised instance must be treated as untrusted: rotate credentials, review web logs for proxy.php abuse, and rebuild from known-good backups.

On October 24, CISA flagged the flaw as actively exploited, alongside a separate vulnerability in Arista VeloCloud. The signal then changes nature: it is no longer a theoretical flaw to patch, but an ongoing campaign to handle as an incident, not a routine patch ticket.

What a defender should look for

The indicators published by detection teams — SentinelOne in particular — are precise and easy to operationalize:

• HTTP requests to proxy.php in the richdocumentscode path containing shell metacharacters: ;, |, `, $(), &&;
• unexpected child processes spawned by the PHP worker or the web-server user, especially interpreters (sh, bash) and network utilities (curl, wget, nc);
• outbound connections from the Nextcloud host to unusual destinations;
• unknown PHP files under the app directory, especially the shx*.php patterns.

These indicators share one trait: they detect behavior, not a binary’s signature. That is consistent with the nature of the attack — a command injection leaves little static trace, but plenty of behavioral trace: a web server that spawns a shell is always abnormal.

The lesson goes beyond Nextcloud

CVE-2026-110447 illustrates a hidden cost of “all-in-one” apps. richdocumentscode exists to simplify deployment: one click in the Nextcloud app store and you have a full office suite without managing a second service. That convenience has a price — an editing-server AppImage, with its own proxy.php entry point, exposed to the internet. It is no accident that deployments running Collabora via Docker or a distribution package are spared: they do not embed that proxy in the same context as Nextcloud.

For a security officer, the rule of thumb is simple: every “built-in” app that bundles a full service adds that service’s attack surface, not just a plugin’s. The question is not “do I use Collabora” but “is richdocumentscode installed and exposed”. Many Nextcloud instances enabled it for a trial and then forgot about it — precisely the profile this campaign targeted.

Verdict

If you run richdocumentscode on an internet-facing Nextcloud, upgrade to 26.4.303 immediately, then treat the hunt as a separate priority: look for shx*.php files and any unexpected PHP under the app directory, and consider the host compromised until you have ruled out a web shell. If you do not need built-in CODE, uninstall richdocumentscode and switch to standalone Collabora via Docker or a distribution package — you remove the flaw along with the component. CVE-2026-110447 is a quantified reminder: a patch is worthless against a shell already planted, and a forgotten optional component is as real an entry point as a primary service.

Références

• NVD — CVE-2026-110447, Collabora Online Built-in CODE Server command injection
• CollaboraOnline/richdocumentscode — issue #354 (advisory and web shell reports)
• Nextcloud Help Forum — To Collabora Built-in users: update ASAP (October 3, 2026)
• The Hacker News — CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud (October 24, 2026)
• SentinelOne — CVE-2026-110447, Collabora Online CODE Server RCE Vulnerability