Skip to content

Nextcloud's Collabora CODE Server has an RCE under active attack

CVE-2026-110447 lets an unauthenticated attacker run shell commands on self-hosted Nextcloud servers through the built-in Collabora CODE app. Update to richdocumentscode 26.4.303.

Source: CollaboraOnline/richdocumentscode (GitHub)

A critical, unauthenticated remote code execution bug in Collabora’s built-in CODE Server app for Nextcloud, tracked as CVE-2026-110447 with a CVSS score of 9.2, has been under active exploitation since mid-September. Attackers are using it to drop PHP webshells on self-hosted servers.

The flaw sits in proxy.php, which starts the local CODE server whenever a request arrives and nothing is listening, such as right after a restart or crash. Versions before 26.4.303 built that startup command by placing request path text straight into a double-quoted bash string, where the shell still expands $(...). No login is needed. The fix shipped in richdocumentscode 26.4.303 on 14 September, but Collabora only published the advisory and CVE on 14 October, a month after attackers had already started planting webshells named shx*.php. Standalone Collabora Online servers and the plain Nextcloud Office app (richdocuments) without the bundled CODE server are not affected.

find / -name "shx*.php" -path "*/richdocumentscode/*"

Why it matters: Nextcloud runs on more than 500,000 self-hosted servers worldwide, and any admin who checks CVE feeds before patching would have found nothing for a month while this was already being exploited. If you run the built-in CODE Server app, update to 26.4.303 now and check for stray webshell files, don’t wait for the CVE to show up in a scan.

The caveat: no one has published how many of those 500,000 Nextcloud installs specifically run the bundled CODE Server rather than a standalone Collabora instance, only that it’s “thousands”.

Share

Related reading

Engineering

The N+1 you cannot see

Everyone knows to eager load. The queries that actually take sites down are the ones hiding in an accessor, a Blade partial, or a policy. There is a one-line switch that finds all of them.

Engineering

Queues are not optional

If your request handler calls somebody else’s API, you have already built a distributed system. The queue is how you stop their bad day from becoming your bad day.

Engineering

PHP got good and nobody told you

If your mental image of PHP is from 2014, it is wrong in ways that would change your architecture. Here is what actually landed, and which parts change how you write code.

More from The Wire

All briefs

GitHub Copilot retires six AI models today

Gemini 3.7 Flash, GPT-5.5, GPT-5.4, GPT-5.4 mini, GPT-5 mini and Grok 4.5 stop working across Copilot Chat, inline edits, agent mode and completions from today.

via GitHub