CVE-2026-110447 lets attackers plant web shells via Nextcloud's Built-in CODE app. Disabling it won't help, and patching won't evict them.
Most security bugs are worst while the software is running. This one only works while it's stopped. It also works when an admin has switched the app off, which is the step most people take first in a panic.
The app is Collabora's Built-in CODE Server for Nextcloud, the add-on that lets a self-hosted Nextcloud open Word and Excel files in the browser. Since September 10, 2026, attackers have been using it to drop PHP web shells on Nextcloud servers and then go looking for password vaults and crypto wallets.
richdocumentscode) for Nextcloud, versions before 26.4.303. CISA added it to the KEV catalog on October 23, 2026.richdocumentscode older than 26.4.303 was exposed. Exploitation began around September 10, 2026, so even patched servers may already hold a web shell.shx*.php and other unexpected PHP files, then upgrade to 26.4.303 or remove the app. Disabling it is not enough.CVE-2026-110447 is a critical (CVSS v4.0 9.2) flaw in proxy.php, the script inside Collabora's Built-in CODE Server app that starts the bundled document server, and it lets anyone on the internet run commands as the web server user. Collabora's advisory says the attack works "only while the built-in CODE server is not running, such as after a container restart, an upgrade, or a crash."
Here's the mechanism in plain words. When the document server is down, proxy.php tries to start it. Up to version 26.4.302, it built that start command as a double-quoted bash string that included text from the web request, The Hacker News explains. Bash expands $(...) inside double quotes, so an attacker who writes a command into the URL gets it executed. The fix, four lines long, passes the command as a single escaped argument instead.
Three details make this one nastier than usual:
richdocuments connector.Yes. Attacks started one day before the fix shipped, and the fix shipped without a security notice. The first logged attack request in GitHub issue #354 is from September 10, 2026, at 19:51 (UTC+2), and version 26.4.303 followed on September 11. Censys's advisory cites one reporter's first malicious request on September 16, but the GitHub thread shows earlier requests, so every check below uses September 10. The CVE and advisory didn't appear until October 14, five weeks into the attacks.
What the attackers did, per the admins in that thread:
/apps/richdocumentscode/proxy.php?status with %2e%2e path traversal, ${IFS} in place of spaces, and a base64 payload piped to sh.shx*.php, earlier shrf*.php) into the app folder. A web shell is a hidden web page that runs any command typed into its URL.webhook.site with the output of uname -a to confirm the infection.*.kdbx (KeePass), wallet.dat, keystore.json, Bitwarden, 1Password and Bitcoin, Electrum, Monero and Ethereum folders. A third admin noticed only because of emails about failed sudo attempts.CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on October 23, 2026. The Hacker News reports a federal deadline of October 26, 2026. As of October 16, Censys knew of no public proof-of-concept, but attackers clearly have one.
A client is exposed if any of their Nextcloud servers has richdocumentscode (or the ARM64 variant, richdocumentscode_arm64) below 26.4.303 and was reachable from the internet at any point since September 10, 2026. Collabora's advisory names only richdocumentscode; Censys notes the ARM64 app's status is unconfirmed, so check it the same way. The commands below use the occ form from Nextcloud's admin manual. For Docker installs, run them through docker exec -u www-data <container> php occ …, and run the file and log checks inside each container and on any reverse proxy in front of it.
/var/www/nextcloud to the client's web root):mkdir -p /root/ir-110447
tar czf /root/ir-110447/app.tgz /var/www/nextcloud/apps/richdocumentscode*
cp -a /var/log/apache2 /var/log/nginx /root/ir-110447/ 2>/dev/null
sha256sum /root/ir-110447/* > /root/ir-110447/SHA256SUMS
sudo -E -u www-data php occ app:list | grep richdocumentscode
EXTRA_FILE is a file Nextcloud didn't ship (what that means):sudo -E -u www-data php occ integrity:check-app richdocumentscode
Nx_33143.php.find / -xdev -path '*richdocumentscode*' \( -name 'shx*.php' -o -name 'shrf*.php' -o -name 'Nx_*.php' \) 2>/dev/null
grep -rlF --include='*.php' 'shell_exec($c' /var/www /srv /opt /home /var/lib/docker 2>/dev/null
find /var/www /srv /opt /home /var/lib/docker -name '*.php' -exec sha256sum {} + 2>/dev/null | grep 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562
zgrep -iE 'richdocumentscode/proxy\.php.*(%2e%2e|%24%28|IFS)' /var/log/apache2/access.log* /var/log/nginx/access.log*
zgrep -F '139.28.18.122' /var/log/apache2/access.log* /var/log/nginx/access.log*
zgrep -F '89.38.98.50' /var/log/apache2/access.log* /var/log/nginx/access.log*
grep -rF 'webhook.site' /var/log 2>/dev/null on the host (repeat in the client's DNS and firewall logs), and zgrep -E 'sudo.*www-data' /var/log/auth.log* (use /var/log/secure* on RHEL-family systems).ps -u www-data -o pid,lstart,args. Collabora's maintainers say leftover processes with remote_font_config.url in their arguments should be harmless, but treat them as suspicious until checked.sudo -E -u www-data php occ group:list admin and sudo -E -u www-data php occ user:lastseen --all, per Nextcloud's user commands.Upgrade richdocumentscode to 26.4.303 or later, or remove it; then, on any server where you found a shell, rebuild and rotate secrets, because the patch doesn't remove anything already planted.
sudo -E -u www-data php occ app:update richdocumentscode, or sudo -E -u www-data php occ app:remove richdocumentscode if the client doesn't need in-browser editing. On Nextcloud 29 or earlier, upgrade Nextcloud first or remove the app. Some admins report that 26.4.402 fails to start on some setups; 26.4.303 also contains the fix.sudo on at least one server. Restore data onto a clean install rather than deleting the PHP file and hoping.config/config.php, SMTP and external-storage credentials, and any API keys on the box. Revoke the old value, confirm it fails, then issue the new one. If any password-vault or wallet files sat on that host, tell the client to change those passwords and move the funds.The confirmed lesson here is general: self-hosted apps that a client put on the internet years ago, with an add-on nobody remembers installing, are a standing risk for every client you serve. Nextcloud is popular with exactly the small businesses, schools and privacy-minded firms MSPs look after.
KinoSec runs autonomous web app and external network pentests across each client's internet-facing surface. It does the reconnaissance to find what is actually exposed, including the Nextcloud box in the corner, looks for vulnerabilities, chains them the way a real attacker would, and writes up every finding with remediation in a report you hand to your client. One honest caveat: this bug only fires while the document server is down, so a single test on a healthy day may not prove it. That's why the version checks above matter, and why running pentests continuously beats a once-a-year snapshot. Patching closes the door, but the hunt in this article is what tells you whether someone already came in.
CVE-2026-110447 is an unauthenticated OS command injection in proxy.php in Collabora Online's Built-in CODE Server app (richdocumentscode) for Nextcloud, versions before 26.4.303. It is rated CVSS v4.0 9.2 and works while the built-in CODE server is not running. Standalone Collabora Online servers are not affected.
First, preserve the app folder and logs, then run occ integrity:check-app richdocumentscode and look for any EXTRA_FILE. Second, search for web shells with find / -xdev -path '*richdocumentscode*' plus the name patterns shx*.php, shrf*.php and Nx_*.php. Third, search access logs back to September 10, 2026 for richdocumentscode/proxy.php requests containing %2e%2e, and for the IPs 139.28.18.122 and 89.38.98.50.
No. Collabora's advisory says "It is not sufficient to disable the app to avoid the problem, it must be upgraded to >= 26.4.303 or removed." Version 26.4.303 needs Nextcloud 30 or later, so older Nextcloud servers must be upgraded or have the app removed.
Yes. CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on October 23, 2026, and The Hacker News reports a federal deadline of October 26, 2026. Exploitation began around September 10, 2026, the day before version 26.4.303 was released.
An autonomous external network and web app pentest such as KinoSec maps a client's internet-facing surface, identifies services like Nextcloud, tests for known vulnerabilities and reports each finding with remediation steps. Because CVE-2026-110447 only fires while the CODE server is stopped, pair the pentest with the version and web-shell checks above.