Nextcloud vulnerability exploited to install web shells
The Nextcloud vulnerability CVE-2026-110447 was exploited to install web shells on servers running the optional Collabora Online - Built-in CODE Server app. A web shell is a small malicious file that accepts commands through web requests and runs them with the web server account's permissions. Three administrators reported compromises on GitHub, with the earliest logged attack occurring on September 10, 2026.
The flaw affects every richdocumentscode version before 26.4.303. It allows an unauthenticated request, meaning one sent without signing in, to trigger command injection and run operating-system instructions. Exploitation is possible only when the local Collabora Online Development Edition (CODE) document server is not running, such as during an upgrade, restart or crash. Collabora released version 26.4.303 on September 11 and published its security advisory on October 14.
The vulnerable app downloads CODE and runs it directly on the Nextcloud host, allowing Nextcloud Office to edit documents without a separate Collabora server. Its app-store description positions it for local testing, personal use, non-production environments and small teams. Standalone Collabora Online servers are not affected. Installations using only the Nextcloud Office app, whose package name is richdocuments, are also outside the affected configuration, whether their separate document server runs through Docker, a Linux package or a hosting provider.
The vulnerable proxy.php file starts the local document server when a request arrives and nothing is listening. Up to version 26.4.302, it inserted request-controlled text, including the request path, into a double-quoted bash command. Bash is a program that interprets operating-system commands, and text written as $(...) inside such a command is executed rather than treated as ordinary text. An attacker could therefore conceal a command in the request path and have it run as the web server user when the script attempted to start CODE.
Simply disabling the app does not resolve the exposure. The web server can execute proxy.php directly from the app directory, and the file does not load Nextcloud's own code to check whether the app is enabled. Administrators must install richdocumentscode 26.4.303 or later, or remove the app completely. The fixed releases require Nextcloud 30 or newer. Nextcloud 29 and earlier are end of life and still receive an affected app version from the store, so those installations must upgrade Nextcloud or remove the built-in app.
The first reporting administrator operated several affected servers on version 26.4.302. Logs from two systems recorded requests at 19:51 on September 10 and 09:56 on September 11, both in UTC+2 and both from the same IP address. The requests targeted proxy.php?status and carried a concealed shell command in the path. That command decoded a one-line PHP web shell into the app directory and attempted to send the output of uname -a, which describes the server's operating system, to a webhook.site address.
On one compromised server, the attacker subsequently searched for credential databases and cryptocurrency wallet files. Search targets included *.kdbx, wallet.dat and keystore.json, along with names associated with Bitwarden, 1Password, Bitcoin, Electrum, Monero and Ethereum. The reviewed commands did not show files being archived, uploaded or copied elsewhere. However, the administrator advised treating anything readable by the web server account as potentially exposed. None of the three reports showed the attacker obtaining root access, the highest level of control on a Linux system.
A second administrator discovered a newly created PHP file after Nextcloud's integrity check, which detects unexpected changes, raised an alert. Another learned of the intrusion from emails reporting failed sudo attempts, meaning attempts to run commands with higher privileges. After one administrator updated to 26.4.303, another similar request arrived from a different IP address on September 14. The malicious text appeared in the CODE startup options, but it did not create a shell file. A project representative said the alarming output should be harmless on the updated version and advised removing any remaining shx*.php files.
Administrators should search apps/richdocumentscode for shx*.php and review access logs from at least September 10 for requests to /apps/richdocumentscode/proxy.php?status. Reported path markers include %2e%2e, $(, ${IFS}, and base64 -d piped to sh. Observed filenames were shrf4645.php, shxa35d0.php, shx5cf91.php, shxd33ce.php, shxf4645.php, shx13a86.php and shx56367.php. The web shell had SHA-256 value 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562. Reported addresses were 139.28[.]18[.]122 and 89.38[.]98[.]50, while callbacks used webhook[.]site with IDs 45060ed4-de0b-4119-8f0d-2a2776bbd413 and 774cf5e1-b5a4-4174-a1ad-0241861029a2.
Version 26.4.402, released September 24, changed the startup process so each option is passed separately. Some administrators reported that this release would not start or open documents in their environments and returned to 26.4.303, which is the version identified by the advisory as the fix. No later release was available as of October 14. A previous repair for the separate proxy.php command-injection issue CVE-2025-66208 does not prevent CVE-2026-110447.
Repository history shows that the four-line correction was written on August 20 and committed on September 9. It escaped the complete startup command as a single argument, preventing request text from being expanded by the shell. The change missed version 26.4.302, released August 31, and version 26.4.303's September 11 release notes mentioned only the bundled CODE build rather than the security impact. A community warning appeared October 3, while the CVE and advisory followed on October 14. The advisory does not state when Collabora learned that the change addressed a security flaw.
The CVE record says exploitation occurred during September and October 2026, but the total number of affected servers remains unknown. Organisations seeking support for their wider web systems can consider AEU-I for security-first IT, infrastructure and consulting. For affected Nextcloud operators, the immediate priorities remain updating or removing richdocumentscode, finding residual web shells and investigating what the web server account could access.