# Hackers Exploit Critical Command Injection Flaw in Collabora CODE Server Attackers leverage unauthenticated web shell execution during server restarts to compromise Nextcloud instances. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-10-14 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/50670a39-596e-42dd-873c-d531c87f8ea4 ## Vulnerability Mechanism Explained The flaw exists within the proxy.php script of the Collabora Online Built-in CODE Server app. When the local document server is inactive, the script incorrectly handles unauthenticated requests by placing path data into a double-quoted bash command. This allows attackers to inject shell commands that execute with web server account privileges. ## Exploitation During Downtime Attacks only succeed when the CODE server is not running, such as during container restarts, system upgrades, or unexpected crashes. Because the script only constructs the vulnerable command when initiating the server, the window of opportunity is limited to these specific maintenance or failure states, making it a highly targeted exploit. ## Attackers Target Sensitive Credentials In observed incidents, attackers deployed PHP web shells to scan for credential stores and cryptocurrency wallets. Files targeted included .kdbx, wallet.dat, and keystore.json, alongside specific service identifiers like Bitwarden, 1Password, and various blockchain wallets. While no root access was reported, any data readable by the web server account remains potentially exposed. ## Inadequacy of Disabling the App Collabora’s advisory explicitly warns that simply disabling the app is insufficient to mitigate the risk. Administrators must either upgrade to version 26.4.303 or completely remove the richdocumentscode package. The fixed version requires Nextcloud 30 or later, leaving users on end-of-life versions like Nextcloud 29 particularly vulnerable to ongoing exploitation attempts. ## Timeline of Disclosure and Attacks The first attacks were logged on September 10, 2026, shortly after the commit on September 9. Collabora released version 26.4.303 on September 11, but the formal CVE-2026-110447 advisory was not published until October 14. Community members warned of active exploitation on the Nextcloud forum as early as October 3, well before the official advisory. ## Technical Fix and Implementation The vulnerability was resolved by modifying four lines in proxy.php. The fix replaces the insecure double-quoted string construction with a single escaped argument passed to bash. This change prevents the shell from expanding malicious text from request paths, effectively neutralizing the command injection vector that enabled the previous unauthorized code execution. ## Scope of Affected Deployments The issue is strictly limited to the Development Edition of Collabora Online when deployed in the specific built-in CODE server mode. Standalone Collabora Online servers and installations using only the standard Nextcloud Office app without the built-in CODE component remain unaffected, regardless of whether they run via Docker or Linux packages. ## Security Implications for Administrators This incident highlights the risks associated with bundled development tools in production environments. Administrators should audit their instances for leftover shx*.php files and ensure all software is updated to the latest patched versions. Relying on community warnings rather than official advisories underscores the critical need for proactive, independent security monitoring. ## Sources covering this story - https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._