errors.x7.al › Recent issues

Hackers reportedly exploit a Collabora flaw to backdoor Nextcloud servers

Attackers are exploiting a critical command-execution vulnerability in an optional Nextcloud app — Collabora Online's built-in CODE server — to plant webshells on servers, according to reports. The flaw is tracked as CVE-2026-110447 and has been fixed in version 26.4.303 of the app.

What's happening

According to BleepingComputer, threat actors are exploiting a critical command execution flaw in the "Collabora Online - Built-in CODE Server" app for Nextcloud, known by its package name richdocumentscode. The issue affects richdocumentscode versions before 26.4.303, and resides in the app's mechanism for starting the bundled Collabora server.

The vendor's advisory describes it as an "unauthenticated OS command injection in the richdocumentscode proxy": a request to the app's proxy.php endpoint can cause an operating system command to run as the web server user. A key prerequisite is that the built-in CODE server must not be running at the time — for example after a container restart, an upgrade or a crash. Authentication or user interaction is not required. Collabora notes this is a different path from an earlier CVE, CVE-2025-66208, and that the fix for that issue does not prevent this one.

Administrator reports cited by BleepingComputer indicate the attacks began in mid-September, roughly a month before the formal advisory and the CVE were published on October 14. A public issue thread on the project shows administrators reporting attacks dating to September 10, including requests aimed at /apps/richdocumentscode/proxy.php?status with base64-encoded shell payloads. According to those reports, the attacker planted PHP webshells that were then used to search for password databases, password-manager artifacts and cryptocurrency wallets — file patterns reported include *.kdbx, wallet.dat, keystore.json and folders for Bitwarden, 1Password, Bitcoin, Electrum, Monero and Ethereum.

Some users also reported that ransomware operators were exploiting the flaw, but BleepingComputer said it could not independently confirm that. The known indicators include the IP address 139.28.18.122 and callbacks to webhook.site, with webshell filenames following a pattern such as /apps/richdocumentscode/shx*.php.

There is a wider point about disclosure timing. BleepingComputer reports that the fix was committed on September 9 and version 26.4.303 released on September 11, but the advisory and CVE appeared on October 14 — a gap of more than four weeks. Collabora attributed the delay mainly to GitHub CVE-processing backlogs, which it said are under strain from rising volumes of AI-driven security reports; Nextcloud said it reported available updates through its app store and gave users time to update.

Who's affected

• Nextcloud administrators running the optional built-in CODE server app (richdocumentscode) in a version before 26.4.303.
• Users of end-of-life Nextcloud versions (29 and earlier), who the advisory says should upgrade Nextcloud itself or remove the app.
• Not affected: standalone Collabora Online servers, Docker and RPM/DEB installations, and Nextcloud All-in-One deployments, according to Collabora.
• Any organisation whose Nextcloud hosted sensitive credentials, since a webshell running as the web server user can read or modify anything that account can reach.

What to do

• Upgrade the app to 26.4.303 or later, or remove it. The advisory warns that merely disabling the app is not enough — it must be upgraded or removed.
• On EOL Nextcloud (29 and below), upgrade Nextcloud or remove the built-in CODE server app.
• Hunt for webshells and IOCs. Look for unexpected PHP files such as /apps/richdocumentscode/shx*.php, and for the IP 139.28.18.122 or webhook.site callbacks in your logs.
• Assume credentials may be exposed. If you find a webshell, treat password databases, password-manager data and crypto-wallet files as potentially compromised, and rotate affected secrets.
• Treat reports of ransomware as unconfirmed, and follow the vendor advisory and the project's issue thread for updates — the situation is evolving.

Sources

• BleepingComputer — reports the exploitation, the affected app and versions, the webshell activity and the disclosure-timing context.
• Collabora security advisory — the vendor's notice of the unauthenticated OS command injection in the richdocumentscode proxy and the 26.4.303 fix.
• richdocumentscode issue #354 — administrators' reports of the attacks, the requests used and the webshells recovered.