Hackers Exploit Collabora RCE Flaw to Backdoor Nextcloud Servers

Threat Actors Backdoor Nextcloud Servers Through Collabora CODE Flaw

Threat actors are actively exploiting a critical command injection flaw, tracked as CVE-2026-110447 (CVSS 9.2), in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. The vulnerability requires no authentication and no user interaction, letting attackers run arbitrary operating-system commands as the web server user and plant PHP web shells directly inside the application folder. Collabora published the formal advisory and CVE on October 14, 2026, but administrator reports and GitHub forensics show attacks began more than a month earlier, with the earliest logged exploitation attempt on September 10, 2026.

Unlike many document-server RCEs, this flaw does not affect standalone Collabora Online deployments, Docker/RPM/DEB installations, or Nextcloud All-in-One (AIO) setups. It is limited to the optional, self-managed Built-in CODE Server feature — a convenience option that downloads and runs a Collabora AppImage directly on the Nextcloud host — but for the servers running it, the impact has already included credential and cryptocurrency-wallet reconnaissance.

Campaign Snapshot

How the Attack Chain Works

A Narrow but Exposed Trigger Condition

The richdocumentscode app installs a bundled Collabora AppImage that Nextcloud launches on demand to render and edit documents. Its proxy.php endpoint is responsible for starting that CODE server process whenever an incoming request finds it not already running — for example immediately after a server restart, an app upgrade, or a crash. In versions before 26.4.303, proxy.php took attacker-controlled request data, including path and query values, and inserted it directly into a shell command string wrapped in double quotes before executing it with sh.

Command Injection via proxy.php?status

Observed attacks send crafted HTTP GET requests to /apps/richdocumentscode/proxy.php?status, using URL-encoded path traversal sequences (%2e%2e) to smuggle shell metacharacters past basic input handling. Because the vulnerable value was interpolated into a double-quoted shell string, any content wrapped in command substitution syntax — $(...) — was executed by the shell rather than treated as plain text. Some logged requests obfuscated the payload further using ${IFS} in place of spaces to dodge naive filtering.

Dropping the Web Shell

Once command execution was achieved, attackers sent a base64-encoded command that wrote a one-line PHP web shell into the richdocumentscode application directory, giving them a persistent, authentication-free foothold reachable over the web. In one documented case, the same injected command also piped the output of uname -a to an external service (webhook.site) — a standard reconnaissance step attackers use to confirm a working callback channel and fingerprint the target before dropping further tooling.

Post-Compromise Reconnaissance

With a web shell in place, operators ran commands with the privileges of the web server account (typically www-data) and searched compromised hosts for:

• Password manager databases and exports — .kdbx files, and artifacts tied to Bitwarden and 1Password
• Cryptocurrency wallet material — wallet.dat, keystore.json, and directories associated with Bitcoin, Ethereum, and Monero

Affected administrators also reported Nextcloud's built-in file integrity checker flagging unexpected changes, and some observed failed sudo attempts suggesting attackers tried — without confirmed success — to escalate from the web server account toward root. No report so far confirms full root compromise or completed data exfiltration, but the intent behind the post-exploitation activity is unambiguous: credential and wallet theft.

Impact Assessment

Recommendations

For Nextcloud Administrators

• Update richdocumentscode to version 26.4.303 or later immediately. This is the only complete fix — disabling the app from the admin panel leaves the vulnerable proxy.php code in place and reachable.
• If the Built-in CODE Server is not actively needed, remove the app entirely rather than relying on disablement.
• Audit the application directory for unauthorized files: search for rogue PHP files matching patterns such as shx*.php or shrf*.php under the richdocumentscode app folder.
• Review web server access logs for requests to proxy.php?status containing encoded traversal sequences (%2e%2e) or unusual query strings.

For Security Teams / Incident Responders

• Treat any Nextcloud instance that ran a vulnerable richdocumentscode version before September 11, 2026 and was internet-facing as potentially compromised, not merely exposed.
• Hunt for any process executing with web server (www-data) privileges that is accessing .kdbx files, wallet.dat, keystore.json, or password manager data stores outside normal application behavior.
• Check for outbound connections to generic callback/testing services (such as webhook.site) originating from the Nextcloud host, which may indicate reconnaissance or exfiltration attempts.
• Review sudo logs for failed or unusual authentication attempts tied to the web server account, and confirm the integrity of PAM and sudoers configuration.
• Rotate credentials and re-key any password vaults or cryptocurrency wallets that were accessible from a compromised host, even absent confirmed theft.

For End Users

• If your organization or community self-hosts Nextcloud with document editing enabled, ask your administrator whether the Built-in CODE Server option is in use and whether it has been patched.
• Avoid storing unencrypted credential exports or wallet seed files on shared servers that also run web-facing applications.

Key Takeaways

1. CVE-2026-110447 is a critical, unauthenticated RCE (CVSS 9.2) in Nextcloud's optional Collabora Online Built-in CODE Server app, exploitable via a crafted request to proxy.php whenever the bundled CODE process is stopped.
2. Exploitation predates disclosure by roughly a month. The patch shipped September 11, 2026, and the first logged attack was September 10, 2026, but the formal CVE and advisory did not appear until October 14, 2026.
3. Disabling the app is not a fix. Only upgrading to richdocumentscode 26.4.303 or later — or removing the app entirely — closes the vulnerable code path.
4. Attackers planted PHP web shells (file names matching shx*.php/shrf*.php) and used them to search for password vaults and cryptocurrency wallets, not just to maintain access.
5. Scope is narrower than a typical Nextcloud-wide flaw. Standalone Collabora Online servers, Docker/RPM/DEB installs, and Nextcloud All-in-One deployments are not affected — only self-managed installs using the Built-in CODE Server option.
6. No confirmed root compromise or exfiltration yet, but failed sudo attempts and active wallet/credential searches indicate attackers are actively trying to escalate impact.

Sources

• BleepingComputer — Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
• SecurityOnline — Critical Nextcloud Collabora Online Flaw CVE-2026-110447 Actively Exploited in the Wild to Deploy Webshells
• GitHub — CollaboraOnline/richdocumentscode issue #354