Critical Collabora Online flaw for Nextcloud lets attackers backdoor servers

What happened

Collabora Online is an office suite for editing documents right in the browser. Many companies use it in Nextcloud through the Collabora Online Built-in CODE Server app (technical name richdocumentscode). The app runs Collabora directly on the Nextcloud server, without a separate server.

This app has a flaw that lets an attacker run their own commands on the server. The problem is in the proxy.php file and shows up when the built-in CODE server is not running, for example shortly after a restart. The vulnerability is tracked as CVE-2026-110447.

One operator spotted the first attack as early as September 10, 2026, and reported it to the app developers the next day. The CVE was published on October 14, 2026. On October 23, 2026, the U.S. agency CISA added the flaw to its catalog of exploited vulnerabilities, so the attacks are real, not theoretical.

Why it is dangerous

This is what is known as OS command injection. Put simply, the app was supposed to treat part of the data coming from the internet as plain text, but at one point it passed that data to the system as a command to run. It is as if someone typed an instruction into a name field and the server carried it out instead of saving the name.

The attacker needs no login or password and can strike from anywhere on the internet. After a successful attack they upload a so-called web shell, a small file they then use to run any command remotely. Those commands run under the web server account, so the attacker can see and change everything that account can reach.

Severity is measured with the CVSS score. The NVD database gives this flaw 9.8 out of 10, which is critical. The original CVE record and the Nextcloud announcement list 9.2 under the newer CVSS 4.0, which is also critical. Being in the CISA KEV catalog means exploitation is confirmed in practice. The EPSS indicator puts the chance of exploitation at just under 12 percent, which places the flaw among the riskiest four percent.

Who is affected

At risk are Nextcloud installations with the Collabora Online Built-in CODE Server app (richdocumentscode) in version 26.4.302 or older. According to the Collabora developers, this concerns the so-called Development Edition in the mode where the app runs Collabora from a local AppImage file directly on the server.

Standalone Collabora Online installations are not affected. You are safe if you only have the richdocuments app without richdocumentscode, if you run Collabora via Docker or from a Linux distribution package, or if you use it through a provider such as IONOS, Hostinger or Cloud42.

The app is mostly found where a company or organization runs its own Nextcloud and wants to edit documents in it without a separate Collabora server.

How to check if you are affected

You can find the app version in the Nextcloud admin under Apps, or on the command line. Run the commands from the Nextcloud folder (often /var/www/nextcloud). Your web server user may have a name other than www-data. All the commands below only read and change nothing.

sudo -u www-data php occ app:list | grep richdocumentscode

If you see version 26.4.302 or lower, you are vulnerable. The built-in integrity check will also list files that do not belong to the app.

sudo -u www-data php occ integrity:check-app richdocumentscode

In your web server access logs, look for requests to proxy.php. The command below also searches older, compressed logs. On Nginx the logs are in /var/log/nginx/. Such requests are normal in everyday use. The suspicious ones contain unusual characters in the address, such as $(, %24%28 or %2e%2e.

zgrep "richdocumentscode/proxy.php" /var/log/apache2/access.log*

How to fix it

Update the richdocumentscode app to version 26.4.303 or newer. This version fixes the flaw and came out back in September 2026.

The fixed version needs at least Nextcloud 30 and no longer supports Nextcloud 29. If you are on an older version, update Nextcloud itself first. Nextcloud recommends moving to a supported version such as 33 or 34.

Make sure you have a fresh backup of the server and its data.
Before updating, run the checks from the previous section so you do not lose traces of a possible attack.
If you run Nextcloud 29 or older, update it to a supported version first.
Update the Collabora Online Built-in CODE Server app to version 26.4.303 or newer.
If you do not need the app, consider removing it. If you still want to edit documents, replace it with a standalone Collabora, for example via Docker.

If you cannot update right away, disable the app, and ideally remove it. Disabling alone may not be enough. Users reported that requests to proxy.php kept arriving even after the app was disabled. Before removing it, check your logs and files as described in the next section so you do not lose traces of the attack.

What if you may already be compromised

If you had a vulnerable version reachable from the internet, especially while the built-in CODE server was not running (after a restart, update or crash), you may have been attacked. Look in the app folder for any unknown PHP files that have appeared.

Real attacks are known to use web shells named like shx*.php and shrf*.php, and a file called Nx_33143.php has also turned up. The integrity check flags them as an extra file (EXTRA_FILE). In your access logs, look for requests to proxy.php?status going back as far as September 10, 2026. Reports mention the IP addresses 139.28.18.122 and 89.38.98.50 and the domain webhook.site.

On compromised servers the attackers searched for passwords and crypto wallets, for example *.kdbx files, wallet.dat and password manager data. If you were vulnerable and the CODE server was down at some point, change every credential the web server account could read as a precaution, above all the database password and app passwords. If you find a web shell or other signs of a break-in, take the server off the network and call in a security expert. Simply deleting the file may not be enough.

Sources

Articles are put together by an AI agent from public sources (vendors, CISA, ENISA, NVD, SK-CERT, NÚKIB), and version numbers and CVEs are checked against them automatically. Always confirm the steps in the vendor advisory before touching production.