Table of contents
18
Read this in 30 seconds: CVE-2026-110447 lets an unauthenticated request run commands on a Nextcloud server that uses the built-in Collabora server, and attackers are already using it to drop PHP webshells. The release that fixed it never says so.
- It is an exploited, critical command injection. The GitHub advisory scores it CVSS 4.0 9.2, CISA added it to the KEV catalog on October 23 with an October 26 deadline, and the entry carries the forensic triage flag.
- The fix for CVE-2026-110447 shipped as a tidy-up. The commit is titled “tidy up how the coolwsd launch command is built”, and the 26.4.303 changelog lists only an AppImage version.
- The first logged attack came 22 hours 31 minutes after that commit’s timestamp. It also landed 19 hours 52 minutes before the fixed release existed. We cannot prove those two facts are connected.
- Disabling the app does not stop CVE-2026-110447. Collabora says the app must be upgraded to 26.4.303 or removed, and admins report webshells that survive an update.
- Admins waited 33 days for a CVE. Version 26.4.303 shipped on September 11 and the advisory arrived on October 14.
The release that fixed CVE-2026-110447 never mentions a security fix, and the first logged attack landed a day before that release existed.
CVE-2026-110447 only bites in one narrow state, which is why it went unnamed for so long, but the state is common enough that three admins reported compromise within a week of the fix. This article covers what the bug is, why a quoting mistake between two shells causes it, how the timeline looks next to the public commit history, and how to check a server you already patched.
Nextcloud can edit office documents through Collabora Online. The Nextcloud app richdocumentscode, listed in the app store as the Built-in CODE Server, bundles a copy of Collabora’s server (CODE stands for Collabora Online Development Edition) and starts it from PHP, so an admin does not need a separate Collabora install.
The GitHub advisory GHSA-g3vx-3m76-fghh is titled “Unauthenticated OS command injection in the richdocumentscode proxy”. It says a request to proxy.php can run an operating system command as the web server user, and that the attack “only works while the built-in CODE server is not running.”
The rest of the record, checked against the advisory, the NVD entry and the CISA KEV JSON:
AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H), assigned by the CNA. NVD lists the record as Deferred and has not scored it, so 9.2 is the only score that exists.richdocumentscode before 26.4.303. Fixed: 26.4.303.The AT:P in the vector means an attack requirement must be present. That requirement is the stopped server. Collabora lists restarts, upgrades and crashes as the usual ways a server ends up in that state.
Collabora has not published a write-up of how CVE-2026-110447 works. What follows is our reading of its public code, and the fix diff supports it.
The launcher lives in startCoolwsd() in proxy.php. It builds one string that starts the bundled server, and some values in it come from the incoming request: the Host header and the request URI. Here is the real code from 26.4.302, shortened with ellipses, next to the real fix from 26.4.303 (both from Collabora’s public compare view):
// 26.4.302 (vulnerable)
$remoteFontConfigUrl = escapeshellarg("https://" . $_SERVER['HTTP_HOST'] . preg_replace(..., $_SERVER['REQUEST_URI']));
$lok_allow = "--o:net.lok_allow.host[14]=" . escapeshellarg($_SERVER['HTTP_HOST']);
$launchCmd = "bash -c \"( $appImage $remoteFontConfig $IPv4only $lok_allow --pidfile=$pidfile || ... ) >/dev/null & disown\"";
// 26.4.303 (fixed)
$innerCmd = "( $appImage $remoteFontConfig $IPv4only $lok_allow --pidfile=$pidfile || ... ) >/dev/null & disown";
$launchCmd = "bash -c " . escapeshellarg($innerCmd);The code did try to be safe. escapeshellarg() wraps each request value in single quotes, which is correct when one shell reads the command. But the whole command is then placed inside double quotes and handed to bash -c, so two shells read it. Inside double quotes, the first shell still expands command substitution, and it treats the single quotes as plain characters.
So a value that was meant to be data gets evaluated by the first shell before the second one ever sees it. The fix wraps the entire inner command in one escapeshellarg() call, which leaves the first shell nothing to interpret.
This matches what admins logged. The public issue shows request paths carrying command-substitution syntax and an encoded .. segment aimed at proxy.php?status. One reporter also saw coolwsd processes with an altered remote_font_config.url, which is the value built from the request URI. A Collabora maintainer said that output “looks scary but should be harmless.”
Two things we did not test. Which of the two request values is reachable depends on the setup, since the URI-based value is only used when the request arrived over HTTPS. And the vulnerable string is built inside the function that launches the server, which fits the advisory’s “server not running” condition, but we have not confirmed every code path that calls it.
We are not reproducing the logged requests. They are public in the issue thread, and the hunting section below gives you the patterns to search for instead.
Every date in the CVE-2026-110447 timeline comes from a primary record: GitHub’s commit and release data, the issue thread, NVD and the KEV JSON.
| Date (UTC) | Event | Source |
|---|---|---|
| 2025-12-03 | CVE-2025-66208 published, an earlier command injection in the same proxy | NVD |
| 2026-08-20 | Fix authored | Commit 6cc8dae5 |
| 2026-08-31 | richdocumentscode 26.4.302 released, the vulnerable build | GitHub release |
| 2026-09-09 19:20 | Fix committed as “tidy up how the coolwsd launch command is built” | Commit 6cc8dae5 |
| 2026-09-10 17:51 | Earliest dated attack in the public record (19:51 +0200) | Issue #354 |
| 2026-09-11 13:43 | 26.4.303 released | GitHub release |
| 2026-09-11 14:53 | Hosting admin opens issue #354 after successful attacks “since yesterday” | GitHub |
| 2026-10-03 | Community forum thread warns “update ASAP”; it notes no CVE exists | Nextcloud forum |
| 2026-10-14 | Advisory and CVE-2026-110447 published | GitHub, NVD |
| 2026-10-23 | CISA adds it to KEV, due October 26 | KEV JSON |
The 26.4.303 changelog entry we checked in the diff lists one thing: the AppImage version, with a link to the CODE release notes. The 26.4.302 entry directly below it lists a “Fix” for an admin-settings bug. Nothing in the release text tells an admin that 26.4.303 closes a remote code execution hole.
One user in the issue thread asked what 26.4.303 changed, since the release notes mention no security fix, and another asked for a CVE on September 29. Our own check of the diff agrees with them.
The intervals, computed from those timestamps:
Our inference, labeled as one: the attack started about a day after a security fix became visible in a public repository under a bland commit message. That is consistent with someone reading the diff. A log line cannot show how an attacker found a target, and a commit’s timestamp is not proof of when it was pushed publicly.
Collabora’s maintainers did warn people in the issue thread. One wrote on September 14, “Please do upgrade,” and on September 18 added that it is “important to upgrade to the latest 26.4.303, and also to remove any lingering shx*.php files.” No advisory existed until October 14.
As BleepingComputer reported, Collabora blamed GitHub CVE-processing backlogs, strained by a rise in AI-driven security reports. Nextcloud said it gave users time to update and had not seen widespread exploitation.
The same article cites Second Security data that the median gap between a public fix and its CVE grew from 5.1 days in January to 39 days in August. We have not verified that figure, but 33 days for this bug sits right inside it.
Issue #354 is the best evidence there is, and it is evidence from admins, not from Collabora. Three people reported compromise through CVE-2026-110447: the hosting admin who opened the issue (several servers), a second admin on September 14, and a third on September 18 who noticed failed sudo attempts.
What they found:
shx.php and shrf.php patterns, such as shxa35d0.php and shrf4645.php.shell_exec. One sample hashes to SHA-256 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562.webhook.site with the host’s uname output, a cheap way to learn which servers worked.*.kdbx, wallet.dat, keystore.json, password manager folders and cryptocurrency wallet directories.BleepingComputer reports that some users claim ransomware operators are involved, and it could not confirm that. We could not either.
A webshell running as the web server account can read everything that account can. That includes the Nextcloud database credentials in config.php, so a clean file listing after the fact is not enough.
No one has published an exposure count for vulnerable servers that we could verify.
You are exposed to CVE-2026-110447 if all of these are true:
richdocumentscode app (the Built-in CODE Server).Collabora says these setups are not affected: standalone Collabora Online servers, Docker and RPM/DEB installations, and Nextcloud All-in-One. The Nextcloud forum thread says the same of setups that use the richdocuments app with an external Collabora server, and a maintainer described the impact as limited to the built-in CODE Server mode.
Disabling the app is not a safe state. The advisory says it “must be upgraded to >= 26.4.303 or removed.”
CISA flagged the CVE-2026-110447 KEV entry for forensic triage, so the order matters. Preserve evidence before you clean up.
apps/richdocumentscode, somewhere off the server.richdocumentscode to 26.4.303 or later to close CVE-2026-110447, or remove the app. Do not stop at disabling it.Run these on the Nextcloud host to check for CVE-2026-110447 compromise. Adjust paths to your install.
# 1. Which version is installed?
sudo -u www-data php occ app:list | grep -i richdocumentscode
# 2. Does Nextcloud's integrity check see files that should not be there?
sudo -u www-data php occ integrity:check-app richdocumentscode
# 3. Look for dropped PHP files by name pattern
find /var/www/nextcloud/apps/richdocumentscode -maxdepth 2 -name '*.php' \( -name 'shx*' -o -name 'shrf*' -o -name 'Nx_*' \)
# 4. Check any PHP file in the app directory against the one published hash
find /var/www/nextcloud/apps/richdocumentscode -name '*.php' -exec sha256sum {} + | grep 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562
# 5. Search web logs back to September 10 for suspicious proxy.php requests
zgrep -hE 'richdocumentscode/proxy\.php' /var/log/nginx/access.log* | grep -Ei '%2e%2e|%24%28|\$\(|\$\{IFS\}'A hit on check 4 confirms the known sample. A miss clears nothing, because the shell names changed per request and the hash is from one recovered file.
| Indicator | Where it came from | Confidence |
|---|---|---|
shx.php, shrf.php in apps/richdocumentscode/ | Issue #354, maintainer reply | Reported by admins and repeated by a maintainer |
Nx_33143.php in the same directory | One Nextcloud forum report | Single report, unverified |
SHA-256 4b9fbd06...c40562 | Issue #354, one recovered sample | One file only |
| Source IPs 139.28.18.122 and 89.38.98.50 | Two admins’ own logs | Attacker infrastructure changes quickly, so treat as leads |
Callbacks to webhook.site | Issue #354 | Shared service, so also catches unrelated traffic |
Requests to proxy.php?status with %24%28, %2e%2e or ${IFS} | Issue #354 | Pattern from several servers |
The forum thread also contains links to third-party “self-test” sites. Moderators flagged the duplicate posting, so we are not recommending any of them. The commands above need nothing outside your own server.
This is not the first bug in this code. NVD records CVE-2025-66208, published December 3, 2025, as a “Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy”, reachable through proxy.php and an intermediate reverse proxy, fixed in 25.04.702. NVD scores it 9.8 and the CNA scores it 7.2.
NVD says CVE-2026-110447 is a different vulnerability, and the advisory adds that the earlier fix does not prevent it. It still means the same file produced two command injections within a year.
The class behind CVE-2026-110447 is not rare in the exploited-bug feed either. We queried the live KEV JSON: 16 of the 272 entries added in 2026 are CWE-78, and 9 of those carry the forensic triage flag.
Quiet fixes have come up before on this site. Our post on CVE-2026-105134 covers a backup server whose first fix shipped silently in a feature release and then failed twice, and CVE-2026-85706 covers older GitLab release lines that waited 13 days for a backport while the bug was already being exploited.
We sell offensive testing, so weigh this section accordingly.
What CVE-2026-110447 shows is how a collaboration server ends up exposed: a convenience app bundles a second service, and nobody lists it as part of the internet-facing attack surface. Our AI VAPT services combine human testers with an agent to map what a company really exposes, including the self-hosted tools people forget they installed.
Managed engagements are priced on our pricing page: the Essential tier starts at $2,500 for one unauthenticated web application or up to 50 host IPs. We do not promise to find every bug, and our terms say AI output can be incomplete or wrong. A test finds what is reachable on the day it runs, which is not a substitute for patching.
XHack does not store your agent chats and cannot access them, so findings about your own infrastructure stay with you.
CVE-2026-110447 is an unauthenticated OS command injection (CWE-78) in proxy.php of the Nextcloud app richdocumentscode, the Built-in CODE Server for Collabora Online. It runs commands as the web server user, only while the built-in server is not running. The CNA scores it CVSS 4.0 9.2.
Yes. Admins reported successful attacks starting September 10, 2026, and CISA added it to the KEV catalog on October 23 with an October 26 deadline and the forensic triage flag. Attackers dropped PHP webshells and searched for password databases and wallet files, according to the public issue thread.
It affects richdocumentscode before 26.4.303. Standalone Collabora Online servers, Docker and RPM/DEB installations, and Nextcloud All-in-One are not affected, per Collabora. Admins running an end-of-life Nextcloud (29 or older) should upgrade Nextcloud or remove the app.
No. The advisory says disabling is not a fix and the app must be upgraded to 26.4.303 or later, or removed. Disabling also does nothing about a webshell that was already dropped, so check the app directory either way.
Run occ integrity:check-app richdocumentscode, look for shx.php and shrf.php files in apps/richdocumentscode, and search your web logs back to September 10 for proxy.php requests with encoded traversal or shell substitution characters. If you find anything, rotate every secret the web server account could read.
The fix shipped September 11 and the CVE on October 14, 33 days later. Collabora blamed GitHub’s CVE-processing backlog, and Nextcloud said it wanted to give users time to update. The 26.4.303 release notes never mentioned a security fix, which is why admins found out from a forum thread.
CVE-2026-110447 is a quoting mistake with a large blast radius: request data reaches a shell that was supposed to treat it as data. It is exploited, it is on CISA’s list, and the only fix that counts is updating richdocumentscode to 26.4.303 or removing the app.
If you run the built-in Collabora server, update today, save your logs first, and look for webshells afterward. A patched server is only a clean server if nobody got there before you.
Categories
Related articles
