Attackers have been exploiting CVE-2026-110447 in the "Collabora Online - Built-in CODE Server" app for Nextcloud since at least September 10, 2026. Collabora shipped the fix on September 11 but didn't publish the advisory and CVE until October 14. If you ran an unpatched copy of this app in that window, look for webshells and assume anything the web server could read is exposed.
What happened
Collabora's GitHub advisory describes an unauthenticated OS command injection (CWE-78) in proxy.php of the richdocumentscode app. A crafted request runs commands as the web server user. It rates the flaw critical, CVSS 4.0 score 9.2. There's a precondition: the bundled CODE server has to be down, which happens during a container restart, an upgrade or a crash. Versions before 26.4.303 are affected and 26.4.303 is the fix. The advisory credits the reporter as wwwshellcodeit.
Collabora says disabling the app is not enough. You have to upgrade it or remove it. Nextcloud 29 and older are end-of-life and can't take the fix, so on those versions the advice is to upgrade Nextcloud itself or uninstall the app. According to BleepingComputer, Collabora says standalone Collabora Online servers, Docker and RPM/DEB installations, and Nextcloud All-in-One deployments are not affected.
The Hacker News reports that three administrators separately reported being exploited. The first documented attack came on September 10, the day after the fix was committed. Attackers dropped one-line PHP webshells into the app directory and used them to search for KeePass databases (*.kdbx), password manager artifacts and crypto wallet files. BleepingComputer says some users reported ransomware operators using the flaw, but it could not confirm those reports. The Hacker News also notes that the December 2025 proxy.php fix for CVE-2025-66208 does not cover this bug.
Why it matters
For about five weeks the fix was available but nothing told you it mattered. There was no CVE, no advisory and nothing for scanners to flag. Collabora told BleepingComputer the delay came mostly from GitHub CVE-processing backlogs, which it said are strained by growing volumes of AI-driven security reports. Teams that prioritize patches by CVE feed would have had no reason to rush a routine app update in September.
What the attackers went after is the identity part of this story. Self-hosted file-sync servers often hold exported password vaults, service account files, keystores and admin credentials that users synced "somewhere safe." The webshells ran as the web server account, so the exposure extends to every file that account can read. Patching stops new break-ins, but it does nothing about secrets that were already taken.
What to check in your environment
- List every Nextcloud instance with the
richdocumentscodeapp installed. Confirm it's on 26.4.303 or later, or remove it. Disabling it does not count. The Hacker News reports stability problems with 26.4.402 and says some admins went back to 26.4.303. - For any instance on Nextcloud 29 or older, plan a Nextcloud upgrade or uninstall the app. The fixed app version won't install there.
- Look for unexpected PHP files under
apps/richdocumentscode/. The names reported by The Hacker News follow ashx*.phppattern (for exampleshxa35d0.php), plusshrf4645.php. - Review web access logs from September 10 onward for requests to
/apps/richdocumentscode/proxy.phpcontaining%2e%2e,$(,${IFS}or base64 piped tosh. Also check for traffic to or from 139.28.18.122 and 89.38.98.50, and callbacks to webhook[.]site. - Check when the CODE server restarted or crashed on each host. The flaw could only be exploited while it was down, so those periods tell you when to look most closely.
- If you find signs of compromise, audit what the web server account could read. Rotate any credentials stored on the server or in synced user files, starting with password vault exports and service account secrets, and tell the owners of those files.
- Add GitHub Security Advisories for the self-hosted apps you rely on to your vulnerability intake, so you aren't depending only on CVE publication.