Collabora CVE-2026-110447: Nextcloud Web Shells, Deadline Today

A convenience app that lets Nextcloud run its own office suite has been handing out web shells since September 10. The fix shipped a day later, but the CVE did not appear for another five weeks, and CISA only added it to its exploited list on Friday. Federal agencies have until today. If the app is merely disabled on your server, you are still exposed.

DataWater Threat Intelligence Desk | Published October 26, 2026 | 8-minute read

Threat level: Critical (exploited)

What: CVE-2026-110447, an unauthenticated OS command injection in Collabora Online Built-in CODE Server (the Nextcloud app package richdocumentscode). Collabora advisory GHSA-g3vx-3m76-fghh scores it CVSS 4.0 9.2.

Status: Exploited in the wild since at least September 10, 2026. Added to CISA’s Known Exploited Vulnerabilities catalog on Friday, October 23. Attribution unknown.

Deadline: CISA’s federal remediation date is today, Monday, October 26, 2026.

Fix: Upgrade richdocumentscode to 26.4.303 or later (requires Nextcloud 30+), or uninstall the app. Disabling it is not enough. Then search the app folder for shx*.php files.

Executive Summary

This is a quiet, self-hosted collaboration server bug with a long head start for attackers.

Nextcloud offers an optional app, Collabora Online Built-in CODE Server, that downloads and runs a local copy of Collabora’s office engine so small deployments can edit documents without a separate server. The app’s proxy.php script tries to start that local engine when a request comes in. In versions up to 26.4.302, parts of the incoming request ended up inside a shell command without proper escaping, so a crafted path could run arbitrary commands as the web server user.

The timeline is the real story. According to The Hacker News and BleepingComputer, the first logged attack hit on September 10. Version 26.4.303 with the fix went out on September 11, but its release notes did not flag a security issue. A Nextcloud community post warned of exploitation on October 3. The CVE and Collabora’s GitHub advisory were not published until October 14, and CISA put CVE-2026-110447 on its KEV list on October 23 with a three-day deadline.

The bottom line: any Nextcloud server that ran a vulnerable build of the app between early September and the day you upgraded should be treated as possibly compromised until you have checked it. Upgrade or uninstall today, then hunt.

Why This Matters to CISOs and Security Leaders

Self-hosted file sharing holds the crown jewels. Teams choose Nextcloud precisely to keep sensitive documents in-house. A web shell running as the web server user can read Nextcloud’s configuration, which typically contains database credentials and application secrets. Italy’s national CSIRT (ACN) reported one case in which a configuration file with credentials was taken, according to one analysis (single-source).

The silent-fix gap left defenders blind. For about five weeks the patch existed but nothing told administrators it was urgent. Collabora told BleepingComputer the delay came mainly from a backlog in GitHub’s CVE processing. Whatever the reason, vulnerability scanners keyed to CVE IDs had nothing to match until mid-October, so asset-based patch programs likely missed it.

It is the same pattern as other self-hosted server bugs this month. Like the Plex2Shell attacks on Plex Media Server, the exposure sits in software that often lives outside the formal IT estate: a departmental Nextcloud, a lab server, a contractor’s instance. CISA’s busy October is summarized in our October 23 KEV weekly roundup.

The Timeline

The fix was out on September 11. The warning that it mattered took five more weeks. Attackers did not wait.

Vulnerability & Exploit Analysis

What CVE-2026-110447 is

CVE-2026-110447 is an OS command injection in the proxy.php script of the Collabora Online Built-in CODE Server app for Nextcloud. When the bundled CODE server is not running, the script builds a Bash command to launch it. Through version 26.4.302, request text, including the URL path, was placed inside a double-quoted shell string, so shell syntax such as $(...) in a request would execute, as The Hacker News describes it. Commands run as the web server account. No authentication is required.

Two conditions matter. First, the app must be installed; it does not need to be enabled. Second, the local CODE server must be stopped at the moment the request arrives. Restarts, upgrades and crashes all create that window. A separate, older flaw in the same script, CVE-2025-66208, was fixed earlier and does not block this path.

Collabora maintainers describe the bug as limited to the Development Edition’s built-in mode, which downloads a local AppImage. NVD has not published its own score; the 9.2 rating comes from Collabora’s advisory, per one analysis.

Affected and fixed versions

Threat Intelligence Breakdown

Attribution: Unknown. No vendor, CERT or news outlet we reviewed has named an actor. Italy’s ACN described the activity as consistent with an automated campaign involving several actors, according to one analysis (single-source). Some users claimed ransomware operators were involved; BleepingComputer said it could not confirm that, and CISA’s KEV entry lists ransomware use as unknown. The number of compromised servers is unknown.

What attackers did after getting in: According to administrator reports summarized by The Hacker News, intruders wrote small PHP web shells into the app folder and, on at least one server, searched for password manager databases and cryptocurrency wallet files such as *.kdbx, wallet.dat and keystore.json. The reviewed requests showed no archiving or upload commands, and no one has reported root access. Another administrator noticed failed sudo attempts by the web server account.

Indicators of compromise (from administrator reports in GitHub issue #354 as compiled by The Hacker News and Rescana; not an official vendor list; defanged):

How to read these: the two IPs are from September and will age quickly. The file-name pattern, the request markers and unexpected PHP files in the app directory are the durable signals. Nextcloud’s built-in integrity check flagged a new PHP file for one administrator, so run it.

Enterprise Impact: What’s Actually at Risk

Nextcloud secrets: The web server account can usually read Nextcloud’s config.php, which holds the database password, the instance secret and often mail credentials. Assume those are exposed on any server with a web shell.

Documents and shares: No source reports document theft so far, but a shell running as the web server user can typically read stored files. Scope what lived on the server before you rule it out.

Credential reuse: Attackers specifically hunted for password vaults and wallets. If staff synced password manager files through Nextcloud, treat those vaults as at risk and rotate what is in them.

Compliance clocks: Self-hosted file servers often carry personal data, which may trigger breach-notification duties if access is confirmed. Record when you upgraded, what you checked and what you found.

What Security Leaders Should Do Next

Today

1. Find every Nextcloud instance and check whether richdocumentscode is installed, enabled or not, and which version.
2. Block external access to proxy.php in the app folder at the reverse proxy or WAF before restarting anything.
3. Preserve web server and Nextcloud logs back to at least September 10, then upgrade to 26.4.303 or later, or uninstall the app. On Nextcloud 29 or older, remove the app now and plan the platform upgrade.
4. Keep evidence before cleanup: copy any shx*.php files and record their timestamps, then remove them.

Within 48 hours

1. Hunt the logs for the request markers and IPs above, outbound requests to webhook[.]site, and sudo attempts by the web server account.
2. Run Nextcloud’s integrity check and look for any unexpected PHP file under apps/.
3. If you find a shell, run an incident: isolate the server, rotate the database password, the instance secret, mail and app passwords from a clean system, and scope which files the web server account could read.

Long-term

1. Move production document editing to a separate Collabora Online server, rather than the built-in mode, which Collabora’s maintainers tie to the Development Edition.
2. Track vendor commits and release notes, not just CVE feeds, for critical self-hosted software. This fix was public for five weeks before a CVE existed.
3. Bring departmental and lab file servers into your asset inventory with a named owner and patch SLA.

Winners and Losers

Final Executive Takeaway

CVE-2026-110447 is a patch you probably already have, and a compromise you may not have checked for.

Attackers had working exploitation before the fix, and five weeks of quiet before the CVE. The upgrade is quick. The forensic look back to September 10 is the part that protects you.

Upgrade or uninstall today. Hunt for shx*.php. Rotate secrets if you find one. For another case where a deadline landed on a Monday after a Friday KEV listing, see our Arista VeloCloud CVE-2026-114625 briefing.

Frequently Asked Questions

Sources

Primary sources: CISA alert, October 23, 2026 and the CISA Known Exploited Vulnerabilities catalog entry for CVE-2026-110447 (KEV listing and due date as reported by Security Affairs); Collabora advisory GHSA-g3vx-3m76-fghh and richdocumentscode GitHub issue #354 (as reported). Additional reporting reviewed: The Hacker News, BleepingComputer, Security Affairs and Rescana (version table, CERT advisories and ACN case, single-source where noted). Reflects public reporting as of October 26, 2026.