Attackers exploited a command-injection flaw in the Collabora Online - Built-in CODE Server app (richdocumentscode) to backdoor Nextcloud servers with web shells. The first logged attack occurred on September 10, and three administrators reported compromised instances. The flaw, tracked as CVE-2026-110447, lets an unauthenticated request run commands as the web server user, but only while the app's local document server is not running—such as during a restart, upgrade, or crash.
The vulnerable proxy.php script placed request text inside a double-quoted bash command, so a hidden $(...) in the path executed during server startup. Collabora patched the issue in version 26.4.303 on September 11. The advisory warns that disabling the app does not prevent exploitation; it must be updated or removed. Standalone Collabora Online servers are not affected, and Nextcloud 29 and older cannot install the fixed version.
In the reported incidents, attackers used the web shell to search for credential stores and cryptocurrency wallet files, including .kdbx, wallet.dat, and keystore.json. No commands exfiltrated files, but anything readable by the web server account should be treated as potentially exposed. Administrators are advised to update or remove the app, delete leftover shx.php files, and review access logs for suspicious proxy.php?status requests.