Overview
- Security researchers and administrators saw unauthenticated exploits in September that used a command‑injection bug in apps/richdocumentscode/proxy.php to run shell commands and plant PHP web shells; Collabora released version 26.4.303 on September 11 and published CVE‑2026‑110447 on October 14.
- The bug came from building a double‑quoted bash start command that let attacker input in the request path expand via $(...) when the local CODE server was not running, enabling remote command execution as the web server user.
- Attackers used the flaw to write one‑line PHP shells into the app folder and to probe for credential stores and cryptocurrency wallets, and administrators should treat any files readable by the web server as potentially exposed.
- Only the Built‑in CODE Server deployment that downloads and runs CODE on the Nextcloud host is affected; externally hosted or standalone Collabora Online setups are not impacted.
- Collabora and responders say disabling the app does not fix the flaw and advise updating to 26.4.303 or removing the app, searching logs for proxy.php?status requests that include markers like %2e%2e, $( or ${IFS}, and deleting any shx*.php files found; Nextcloud 29 and older must upgrade Nextcloud or remove the app because they cannot install the fixed release.