Collabora Online Built-in CODE Server (richdocumentscode) Unauthenticated OS Command Injection via proxy.php

CVE-2026-110447 is an unauthenticated OS command injection in proxy.php within the richdocumentscode Nextcloud app (Collabora Online Built-in CODE Server) affecting all versions before 26.4.303. When the embedded CODE server process is not running — a transient state triggered by container restarts, upgrades, crashes, or resource pressure — crafted HTTP GET requests to /apps/richdocumentscode/proxy.php?status pass attacker-controlled input through the remote_font_config.url parameter into a shell invocation of Collabora_Online.AppImage. Shell command substitution via $() and ${IFS} whitespace obfuscation gives the attacker arbitrary OS command execution as the www-data web server user. Standalone Collabora Online Docker/RPM/DEB deployments and Nextcloud All-in-One are not affected — only the optional built-in CODE app.

The GitHub Security Advisory (GHSA-f97p-r72q-64h2) carries a CVSS 4.0 score of 9.2, which is appropriate for the unauthenticated-network-RCE mechanics but slightly generous given the AT:P (attack-timing prerequisite) condition requiring the CODE server to be stopped. In practice, however, this friction point has been completely overcome by real-world attackers who began exploiting this flaw on September 10, 2026 — one day after the fix was committed and one day before v26.4.303 shipped — a full 34 days before the CVE was even published on October 14. Attackers are deploying PHP web shells (shx*.php, shrf*.php) and using them to harvest password databases, password manager vaults (Bitwarden, 1Password, *.kdbx), and cryptocurrency wallets. The gap between severity label and reality here is the opposite of the usual story: the *timing* condition that the CVSS vector encodes as friction is trivially defeated by continuous scanning, and the execution-as-www-data limitation understates impact because www-data owns every file in the Nextcloud data directory plus config.php (which contains the database password).

Sources.

1. BleepingComputer — Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
2. GitHub Advisory GHSA-f97p-r72q-64h2
3. SecurityOnline — CVE-2026-110447 Actively Exploited
4. DEV Community — Pre-Authentication OS Command Injection Technical Analysis
5. CybersecurityNews — Hackers Exploit Critical Collabora Online Flaw
6. CVEFeed.io — CVE-2026-110447 Detail
7. PoC Repository — adriyansyah-mf/cve-2026-110447
8. Aviatrix Threat Research — Nextcloud Collabora Web Shell Backdoor Attack

Run this script on the Nextcloud host as root or the www-data user. Pass the Nextcloud web root as the first argument. Example: sudo bash check_cve_2026_110447.sh /var/www/nextcloud. The script checks whether the vulnerable app is installed, its version, and scans for known web shell IOCs. No network access or special packages required beyond grep, find, and sort.

#!/usr/bin/env bash
# CVE-2026-110447 Checker — richdocumentscode OS Command Injection
# Exit codes: 0 = PATCHED/not-installed, 1 = VULNERABLE, 2 = UNKNOWN
set -uo pipefail

NC_ROOT="${1:-/var/www/nextcloud}"
FIXED_VER="26.4.303"
RESULT="UNKNOWN"

if [[ ! -d "$NC_ROOT" ]]; then
  echo "[!] Nextcloud root not found at $NC_ROOT"
  echo "UNKNOWN"
  exit 2
fi

# Locate richdocumentscode in either app directory
TARGET=""
for d in "$NC_ROOT/apps/richdocumentscode" "$NC_ROOT/custom_apps/richdocumentscode"; do
  [[ -d "$d" ]] && TARGET="$d" && break
done

if [[ -z "$TARGET" ]]; then
  echo "[*] richdocumentscode app not found — this host is NOT affected."
  echo "PATCHED"
  exit 0
fi

# Parse installed version
INFO="$TARGET/appinfo/info.xml"
if [[ ! -f "$INFO" ]]; then
  echo "[!] Cannot find $INFO — manual inspection needed."
  echo "UNKNOWN"
  exit 2
fi

VER=$(grep -oP '<version>\K[^<]+' "$INFO" 2>/dev/null || true)
if [[ -z "$VER" ]]; then
  echo "[!] Could not parse version from $INFO"
  echo "UNKNOWN"
  exit 2
fi

echo "[*] richdocumentscode installed at: $TARGET"
echo "[*] Installed version: $VER"
echo "[*] Fixed version:     $FIXED_VER"

# Compare versions (sort -V)
LOWEST=$(printf '%s\n' "$VER" "$FIXED_VER" | sort -V | head -n1)
if [[ "$VER" == "$FIXED_VER" || "$LOWEST" == "$FIXED_VER" ]]; then
  RESULT="PATCHED"
  echo "[+] VERSION CHECK: PATCHED ($VER >= $FIXED_VER)"
else
  RESULT="VULNERABLE"
  echo "[!] VERSION CHECK: VULNERABLE ($VER < $FIXED_VER)"
fi

# IOC scan
echo ""
echo "--- IOC Scan (known web shell patterns) ---"
IOC=0
for pat in 'shx*.php' 'shrf*.php'; do
  HITS=$(find "$TARGET" -name "$pat" -type f 2>/dev/null)
  if [[ -n "$HITS" ]]; then
    echo "[!!] WEBSHELL INDICATOR: $HITS"
    IOC=1
  fi
done

# Check for any .php files newer than info.xml (rogue drops)
ROGUE=$(find "$TARGET" -name '*.php' -newer "$INFO" -type f 2>/dev/null \
  | grep -vE '/(proxy|index|ajax|wopi|fonts)\.php$' || true)
if [[ -n "$ROGUE" ]]; then
  echo "[!!] SUSPICIOUS PHP files newer than info.xml:"
  echo "$ROGUE"
  IOC=1
fi

if [[ $IOC -eq 0 ]]; then
  echo "[+] No known IOCs found."
else
  echo "[!!] IOCs DETECTED — initiate incident response immediately."
fi

echo ""
echo "$RESULT"
[[ "$RESULT" == "VULNERABLE" ]] && exit 1
[[ "$RESULT" == "UNKNOWN" ]] && exit 2
exit 0