{"id":3543,"date":"2026-10-14T20:12:02","date_gmt":"2026-10-14T20:12:02","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3543"},"modified":"2026-10-14T20:12:02","modified_gmt":"2026-10-14T20:12:02","slug":"hackers-backdoor-nextcloud-servers-through-critical-flaw-in-collaboras-built-in-code-app","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3543","title":{"rendered":"Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora\u2019s Built-in CODE App"},"content":{"rendered":"
\n
<\/a><\/div>\n

Attackers exploited a flaw in an optional Nextcloud app, Collabora Online – Built-in CODE Server<\/a>, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub<\/a>, with the first logged attack on September 10.<\/p>\n

A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw allows an unauthenticated request to run a command on the server, but only when the app’s local document server is not running, such as during a restart or upgrade, or after a crash.<\/p>\n

Collabora fixed it in version 26.4.303<\/a> on September 11 and on October 14 published an advisory<\/a> with the identifier CVE-2026-110447<\/a>, warning that turning off the app does not help: it must be updated or removed.<\/p>\n

Who Is Affected<\/h3>\n

The app, published by Collabora under the package name richdocumentscode, downloads a copy of Collabora Online Development Edition (CODE) and runs it on the Nextcloud server itself.<\/p>\n

That lets Nextcloud Office edit documents without a separate Collabora server. Its store listing says it is \u00abfor local testing and non-production use\u00bb and \u00abfor personal use or for small teams.\u00bb<\/p>\n

Collabora’s advisory covers every version before 26.4.303 and says standalone Collabora Online servers are not affected. A warning posted on the Nextcloud community forum<\/a> on October 3 stated that an installation is not affected if it uses only the Nextcloud Office app ( richdocuments) without the built-in app, whether its Collabora server runs in Docker, from a Linux package, or at a hosting provider.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The app’s proxy.php script starts the local CODE server whenever a request arrives, and nothing is listening. In versions up to 26.4.302, the script placed text from the request, including its path, inside a double-quoted bash command, where the shell still runs anything written as $(…).<\/p>\n

<\/p>\n

A request with a command hidden in its path ran that command as the web server user. Because the script only builds that command when it needs to start the server, the attack works only while the server is down, such as during a container restart, an upgrade, or a crash.<\/p>\n

The script is a plain PHP file that the web server runs directly from the app’s folder and loads none of Nextcloud’s code.<\/p>\n

\u00abIt is not sufficient to disable the app to avoid the problem; it must be upgraded to >= 26.4.303 or removed,\u00bb Collabora said in the advisory.<\/p>\n

The fixed versions require Nextcloud 30 or later<\/a>.<\/p>\n

Nextcloud 29 and older are end of life, and the app store still serves them an affected version, so their users should upgrade Nextcloud or remove the app. Collabora’s fix for a separate command-injection flaw in the same script, CVE-2025-66208<\/a>, disclosed last December, does not prevent this one.<\/p>\n

What the Attackers Did<\/h3>\n

The first report came from an administrator who hosts several Nextcloud servers and wrote on GitHub that the servers had been hacked since the day before. Access logs from two of them show requests at 19:51 on September 10 and 09:56 on September 11 (UTC+2), both from one IP address and both aimed at proxy.php?status with a shell command hidden in the request path. All of the administrator’s servers ran version 26.4.302.<\/p>\n

The command decoded a one-line PHP web shell into the app’s folder and tried to send the server’s uname -a output to a webhook.site address. On one server, the attacker then used the shell to search for credential stores and cryptocurrency wallets, including *.kdbx, wallet.dat and keystore.json files and names such as bitwarden, 1password, .bitcoin, .electrum, .monero and .ethereum.<\/p>\n

The reviewed requests showed no commands that archived, uploaded, or copied out files, but anything the web server account can read must be treated as potentially exposed, the administrator wrote.<\/p>\n

Two other administrators reported the same on their own instances. One found the shell when Nextcloud’s integrity check flagged a new PHP file, and the other learned of the break-in from emails about failed sudo attempts on the server. None of the reports show the attacker gaining root access.<\/p>\n

After updating to 26.4.303, one of them logged another attempt on September 14 from a second IP address with a payload of the same kind. The CODE server it started carried the attack text in its startup options, but no new shell file appeared. The output \u00ablooks scary but should be harmless,\u00bb replied mmeeks, who answered for the project in the thread, telling users to update and to remove any leftover shx*.php files.<\/p>\n

The CVE record describes the flaw as \u00abexploited in the wild in September and October 2026.\u00bb How many servers were hit is not known. \u00abThis impacts only the Development Edition, and only in this (rather rarer) Built-in CODE Server deployment mode that downloads a local appimage,\u00bb mmeeks wrote.<\/p>\n

What to Do Now<\/h3>\n

What to do, in order:<\/p>\n

    \n
  1. Update richdocumentscode<\/code>, which appears in Nextcloud’s app list as Collabora Online – Built-in CODE Server, to 26.4.303 or later, or remove the app. Disabling it in Nextcloud does not close the flaw.<\/li>\n
  2. On Nextcloud 29 or older, which cannot install 26.4.303, upgrade Nextcloud or remove the app.<\/li>\n
  3. If you already updated, look for shx*.php<\/code> files, starting in apps\/richdocumentscode<\/code>, and delete them. Then check your access logs back to at least September 10 for proxy.php?status<\/code> requests whose path contains %2e%2e<\/code>, $(<\/code> or ${IFS}<\/code>, and look for sudo<\/code> attempts by the web server account. Treat anything that account could read as potentially exposed, as the first reporter advised.<\/li>\n
  4. Version 26.4.402, released September 24, rewrote the start command to pass each option as a separate argument, but administrators report that it fails to start<\/a> or fails to open documents<\/a> on some setups and have gone back to 26.4.303, the version the advisory names as the fix. No newer release had appeared as of October 14.<\/li>\n<\/ol>\n

    Indicators from the administrators’ logs:<\/p>\n