psf-collabora-code-oct2026-mitigate(8)
Nextcloud Collabora Built-in CODE Server command injection: mitigation (v1)
CVE-2026-110447
If this software is helpful, consider a donation to our 501c3 nonprofit:
https://privacysafe.foundation
The optional Nextcloud app "Collabora Online - Built-in CODE Server"
(package richdocumentscode) ships a proxy.php that the web server runs
directly, outside Nextcloud's code. Before 26.4.303 it built the command to
start the local CODE server by placing text from the request, including its
path, inside a double-quoted bash string, so a request with $(...) in its
path ran commands as the web server account, without logging in. It is
reachable only while the local CODE server is down (a restart, upgrade or
crash), which is when proxy.php tries to start it. The flaw has been
exploited in the wild since September 2026 to plant PHP web shells
(apps/richdocumentscode/shx*.php). Collabora is explicit that DISABLING the
app is not enough, because proxy.php is served whether or not the app is
enabled: it must be updated to >= 26.4.303 or removed. The fixed app needs
Nextcloud 30 or later; on Nextcloud 29 and older, upgrade Nextcloud or
remove the app. Standalone Collabora Online servers, and Nextcloud Office
(richdocuments) without the built-in app, are not affected. A separate
earlier command-injection fix in the same script does not close this one.
The real fix is to update richdocumentscode to >= 26.4.303 or remove it,
which this script does not do for you (an app-store update or removal, run
through Nextcloud's occ, is the administrator's call). What apply does is an
reversible mitigation: it neutralizes the exploited proxy.php on a
vulnerable install by replacing it with a stub that returns HTTP 403 and
builds no command, backing the original up first. That closes the exploited
path at once and disables the built-in CODE server until you update or
remove the app; restore puts the original back, and an app update replaces
the stub with the fixed proxy.php on its own.
Usage:
./collabora-code-oct2026-mitigate.sh [command]
check (default) find every Nextcloud with the built-in CODE app, report
the app version (fixed at 26.4.303), the Nextcloud version
(the fix needs 30+), and the proxy.php state. Read-only,
root optional. Exit 0 = nothing exposed, 1 = a vulnerable
app is present, 2 = something couldn't be read.
apply neutralize the exploited proxy.php on every vulnerable
install (backup first, idempotent, reversible). Needs
write access to the app, so run as root or the web user.
Refuses an already-fixed app unless --force.
restore put the original proxy.php back where apply replaced it.
status show which installs this script has mitigated.
hunt read-only: the app folders for planted web shells
(shx*.php and a known shell by hash) and the web server
access logs for the exploitation markers. Exit 0 = clean,
1 = findings, 2 = no app folder and no readable log, so
nothing was searched.
version print the script version.
Env overrides:
NC_PATHS="/var/www /srv /opt" where to look for Nextcloud installs
RICHDOC_FIXED=26.4.303 first fixed app version
NC_MIN_FOR_FIX=30 Nextcloud major the fixed app requires
BACKUP_ROOT=/var/backups/collabora-code-oct2026
HUNT_SINCE="2026-09-01" how far back hunt reads the journal
HUNT_LOGS="/srv/app/log/*.log" extra access-log globs for hunt
PSF_LOCK_WAIT seconds a run that changes the host waits for another one that is already
changing it (default 30), then stops with exit 2; the lock is STATE_DIR/.lockThe Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.
