THREAT actors are actively exploiting CVE-2026-110447, a critical OS command injection flaw in the Nextcloud Collabora Online Built-in CODE Server app (richdocumentscode). The vulnerability, rated CVSS 9.2, enables unauthenticated attackers to plant PHP webshells on exposed servers. Affected installations include Nextcloud setups that use the Collabora Online Development Edition built into Nextcloud; standalone Collabora Online servers or those without the richdocumentscode component are not affected.
The issue has been observed in the wild throughout September and October 2026, with confirmed reports of unauthorised PHP webshells on compromised hosts and attackers performing post-access discovery targeting password databases and cryptocurrency wallets.
The weakness stems from how the richdocumentscode wrapper launches the Collabora AppImage via a PHP execution path, allowing OS command injection via the proxy[.]php handler when the CODE server is not running (for example after a reboot). For exploitation, attackers send crafted requests to /apps/richdocumentscode/proxy[.]php?status with encoded path traversal, leading to shell commands executed through sh and the deployment of webshells named /apps/richdocumentscode/shx*.php or shrf*.php.
Patch details specify that version 26.4.303 or newer mitigates the flaw; administrators are urged to upgrade to 26.4.303+ or remove the built-in server if unused, and to inspect /apps/richdocumentscode/ for rogue files, terminate suspicious www-data processes, and rotate secrets accessible to the web server user.