Content management and web applications

Nextcloud: Collabora Built-in CODE (CVE-2026-110447)

Nextcloud Collabora Built-in CODE Command Injection

CVE-2026-110447 is an unauthenticated OS command injection in Nextcloud's optional "Collabora Online - Built-in CODE Server" app (package richdocumentscode), which downloads a copy of Collabora Online Development Edition and runs it on the Nextcloud server itself. The app's proxy.php starts that local server when a request arrives and nothing is listening. Before 26.4.303 it built the start command by placing text from the request, including its path, inside a double-quoted bash string, so a request with $(...) in its path ran commands as the web server account. It is reachable only while the local CODE server is down (a restart, upgrade or crash), which is exactly when proxy.php tries to start it. The flaw has been exploited in the wild since September 2026 to plant PHP web shells under apps/richdocumentscode/ (files named shx*.php), which then search for credential stores and wallets.

The key operational point, from Collabora's advisory: disabling the app is not enough. proxy.php is a plain PHP file the web server runs directly, outside Nextcloud's code, so it stays reachable whether or not the app is enabled. The fix is to update richdocumentscode to 26.4.303 or later, or remove the app. The fixed app requires Nextcloud 30 or later. On Nextcloud 29 and older (end of life), upgrade Nextcloud or remove the app. Standalone Collabora Online servers, and Nextcloud Office (richdocuments) without the built-in app, are not affected.

This script does not run the update or removal for you, since that is an app-store or occ action an administrator should time. What it does: find affected installs, apply a reversible block by neutralizing the exploited proxy.php, and hunt for the web shells and request markers the attacks leave behind.

Nextcloud Collabora quick start

1. Download the script. The repository is mirrored on GitHub and Codeberg; pick a base URL.

   # BASE from GitHub:   https://raw.githubusercontent.com/PrivacySafe/security-patches/refs/heads/main
   # BASE from Codeberg: https://codeberg.org/PrivacySafe/security-patches/raw/branch/main
   # curl -fLO "$BASE/nextcloud/collabora-code-oct2026-mitigate.sh"
   curl -fLO https://raw.githubusercontent.com/PrivacySafe/security-patches/refs/heads/main/nextcloud/collabora-code-oct2026-mitigate.sh
   

2. Read it before running it, then make it executable.

   less collabora-code-oct2026-mitigate.sh
   chmod +x collabora-code-oct2026-mitigate.sh
   

3. See what's affected. This changes nothing.

   sudo ./collabora-code-oct2026-mitigate.sh check
   

4. Apply the block if you cannot update or remove the app immediately. It backs up proxy.php first and is reversible.

   sudo ./collabora-code-oct2026-mitigate.sh apply
   

5. Hunt for web shells and attack markers.

   sudo ./collabora-code-oct2026-mitigate.sh hunt
   

Nextcloud Collabora commands

Commands that change the host need root. Run them with sudo from an admin account, not from a root login, so the change is recorded against a person. The script stops and prints the exact command if you forget:

sudo ./collabora-code-oct2026-mitigate.sh apply
sudo ./collabora-code-oct2026-mitigate.sh restore

Why apply edits proxy.php rather than disabling the app

Because disabling the app does nothing: the web server serves proxy.php directly, outside Nextcloud. Neutralizing that one file closes the exploited path at once, no matter how the app is enabled or which web server is in front, and it is reversible (restore) and self-healing (an app update to 26.4.303 replaces the stub with the fixed proxy.php). The fix is to update the app to 26.4.303 or later, or remove it.

Nextcloud Collabora configuration

Before you run it

• The real fix is update or remove, which this script does not do for you. Update richdocumentscode to 26.4.303 or later, or remove the app through Nextcloud. apply is a reversible block that protects the app until you update.
• Disabling the app does not help. proxy.php runs directly from the web server, so it stays reachable when the app is disabled. This is why apply edits that file.
• apply disables the built-in CODE server. Document editing through the built-in CODE server stops until you update the app (which restores a safe proxy.php) or restore and then update. The app is for local, non-production use by its own description.
• Neutralizing proxy.php trips Nextcloud's integrity check. That is expected: the file is intentionally changed. The integrity check is also a useful detector here, since it flags a planted web shell as a new file.
• If you were already exploited, closing the hole is not enough. Run hunt, delete any shx*.php under apps/richdocumentscode/, and treat anything the web server account could read as exposed: rotate credentials and check for access to credential stores and wallets.
• On Nextcloud 29 and older the fixed app cannot be installed. Upgrade Nextcloud to 30+ or remove the app.
• GNU/Linux only , and it finds installs under NC_PATHS. Point NC_PATHS at an install kept elsewhere.
• Only --force is a recognized option. Any other option is refused with exit 2, so a mistyped or invented flag (for example restore --dry-run) can never turn into a real apply or restore.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.

Edit this page on Codeberg