Attackers Exploited Collabora Built-in CODE Server Flaw to Plant Web Shells on Nextcloud Servers

Attackers used a vulnerability in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers, according to three administrators who reported the incidents on GitHub. The first logged attack occurred on September 10.

A web shell is a small file that runs any command an attacker sends through a web request, with the permissions of the web server account. The flaw allowed an unauthenticated request to execute a command on the server, but only while the app's local document server was not running, such as during a restart, upgrade or crash.

Collabora fixed the issue in version 26.4.303 on September 11 and published an advisory on October 14 under the identifier CVE-2026-110447. The advisory warns that disabling the app is not enough; it must be updated or removed. The flaw affects all versions before 26.4.303, and standalone Collabora Online servers are not affected. The fixed versions require Nextcloud 30 or later, and Nextcloud 29 and older are end of life.

The app, published under the package name richdocumentscode, downloads a copy of Collabora Online Development Edition and runs it on the Nextcloud server itself. According to the advisory, the proxy.php script placed text from a request, including its path, inside a double-quoted bash command, allowing a hidden command to run as the web server user.

The first reporter's access logs show requests on September 10 and 11 from a single IP address aimed at proxy.php?status with a shell command hidden in the request path. The command decoded a one-line PHP web shell into the app's folder and tried to send the server's uname -a output to a webhook.site address. On one server, the attacker then searched for credential stores and cryptocurrency wallets. None of the reports show the attacker gaining root access.

After updating to 26.4.303, one administrator logged another attempt on September 14 from a second IP address. The CODE server it started carried the attack text in its startup options, but no new shell file appeared. The CVE record describes the flaw as exploited in the wild in September and October 2026; how many servers were hit is not known.

Administrators are advised to update the app to 26.4.303 or later, or remove it, and to check for shx*.php files starting in apps/richdocumentscode. The advisory credits a GitHub user, wwwshellcodeit, as the reporter.

Source: The Hackers News