Hackers Exploit Critical Command Injection Flaw in Collabora CODE Server
Attackers leverage unauthenticated web shell execution during server restarts to compromise Nextcloud instances.
1Vulnerability Mechanism Explained
The flaw exists within the proxy.php script of the Collabora Online Built-in CODE Server app. When the local document server is inactive, the script incorrectly handles unauthenticated requests by placing path data into a double-quoted bash command. This allows attackers to inject shell commands that execute with web server account privileges.
2Exploitation During Downtime
Attacks only succeed when the CODE server is not running, such as during container restarts, system upgrades, or unexpected crashes. Because the script only constructs the vulnerable command when initiating the server, the window of opportunity is limited to these specific maintenance or failure states, making it a highly targeted exploit.
3Attackers Target Sensitive Credentials
In observed incidents, attackers deployed PHP web shells to scan for credential stores and cryptocurrency wallets. Files targeted included .kdbx, wallet.dat, and keystore.json, alongside specific service identifiers like Bitwarden, 1Password, and various blockchain wallets. While no root access was reported, any data readable by the web server account remains potentially exposed.
4Inadequacy of Disabling the App
Collabora’s advisory explicitly warns that simply disabling the app is insufficient to mitigate the risk. Administrators must either upgrade to version 26.4.303 or completely remove the richdocumentscode package. The fixed version requires Nextcloud 30 or later, leaving users on end-of-life versions like Nextcloud 29 particularly vulnerable to ongoing exploitation attempts.
5Timeline of Disclosure and Attacks
The first attacks were logged on September 10, 2026, shortly after the commit on September 9. Collabora released version 26.4.303 on September 11, but the formal CVE-2026-110447 advisory was not published until October 14. Community members warned of active exploitation on the Nextcloud forum as early as October 3, well before the official advisory.
6Technical Fix and Implementation
The vulnerability was resolved by modifying four lines in proxy.php. The fix replaces the insecure double-quoted string construction with a single escaped argument passed to bash. This change prevents the shell from expanding malicious text from request paths, effectively neutralizing the command injection vector that enabled the previous unauthorized code execution.
7Scope of Affected Deployments
The issue is strictly limited to the Development Edition of Collabora Online when deployed in the specific built-in CODE server mode. Standalone Collabora Online servers and installations using only the standard Nextcloud Office app without the built-in CODE component remain unaffected, regardless of whether they run via Docker or Linux packages.
8Security Implications for Administrators
This incident highlights the risks associated with bundled development tools in production environments. Administrators should audit their instances for leftover shx*.php files and ensure all software is updated to the latest patched versions. Relying on community warnings rather than official advisories underscores the critical need for proactive, independent security monitoring.