Disabling the App Doesn't Fix It: Nextcloud's Built-in Collabora Server Is Being Exploited

PHP2Shell is soaking up all the attention, so this one slipped under the radar, including mine. It shouldn't have. CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on October 23, and the federal deadline to fix it is today.

What's Broken

The flaw is in the Collabora Online Built-in CODE Server, the Nextcloud app (richdocumentscode) that gives you document editing without standing up a separate Collabora server. Its proxy.php script dropped request data into a Bash command without sanitizing it. Result: an unauthenticated attacker can run OS commands as the web server user. CVSS 9.2.

There's a catch that makes it sneakier: it only works while the built-in CODE server isn't running, like during a restart, an upgrade, or after a crash. So it's opportunistic. Attackers keep knocking until they catch the door open.

It's Been Going On Since September

Admins reported web shells going back to September 10. Attackers dropped PHP shells, went looking for credential stores and crypto wallets, and grabbed config files with credentials and application secrets. That's six weeks of exposure before it hit KEV.

The Trap

Here's the part that'll catch people. Collabora says plainly: "It is not sufficient to disable the app." The vulnerable code is still sitting there. You have to upgrade to 26.4.303 or later, or remove the app entirely.

Also worth knowing: standalone Collabora Online servers, the Docker images, and the RPM/DEB packages aren't affected. This is specifically the built-in, all-in-one-app convenience version, which Collabora itself says isn't recommended for production. And yet, here we are, because convenient things end up in production. Every time.

What To Do Today

• Find it. Check every Nextcloud instance for richdocumentscode, including the ones someone set up for a team and forgot.
• Upgrade or remove. 26.4.303 or later. If you're on Nextcloud 29 or older and can't get a fixed version, remove the app.
• Hunt back to September 10. Look for unexpected PHP files in the app folder (Collabora's maintainer called out leftover shx*.php files), run Nextcloud's integrity check, and review logs for requests to proxy.php.
• If you find anything, isolate the server and rotate database, mail, and app passwords and secrets from a clean machine. Upgrading doesn't remove a web shell.
• Better long term: don't expose your file sharing server to the whole internet if your users are the only ones who need it. Put it behind Zero Trust access and the scanners never see it.

Bottom Line

"Disabled" and "fixed" are not the same thing, and "patched" and "clean" aren't either. Six weeks of quiet exploitation means the patch is step one. The hunt is step two.

Sources: Security Affairs on the KEV addition, Rescana's breakdown with Collabora's guidance, and Collabora's advisory