HACKERS compromised a Nextcloud deployment by exploiting a flaw in Collabora Online’s Built-in CODE Server app (Richdocumentscode). Attackers sent unauthenticated requests to proxy[.]php while the local CODE server was not running (for example during restarts, upgrades or after a crash), causing the script to place a command inside a double-quoted bash command. This allowed the shell to execute attacker-supplied commands and plant a PHP web shell in the app’s folder.
The first confirmed exploitation occurred on 10 September, with subsequent attempts on 11 September and 14 September; admins reported the presence of shell files and credential searches on affected servers. Evidence from logs included requests targeting proxy[.]php?status with a shell command hidden in the path, and payloads attempted to exfiltrate or probe for credential stores and wallets. The issue was tracked under CVE-2026-110447, described as exploited in the wild during September and October 2026.
Collabora patched the vulnerability in version 26.4.303 (released 11 September 2026) and issued an advisory on 14 October 2026. The fix changed the CODE start command to pass options to bash as a single escaped argument, preventing the request content from expanding in the shell. The advisory notes that turning the app off is not sufficient; users must update or remove the built-in CODE Server app.
The fix requires Nextcloud 30 or later; Nextcloud 29 and older are end of life, and users on those versions must upgrade Nextcloud or remove the app. Administrators are advised to search for shell files (shx*.php) and review access logs for suspicious proxy[.]php?status requests, and to remove any potentially exposed files and assess server read access.