Hackers have been exploiting a critical command execution flaw in the Collabora Online Built-in CODE Server app (richdocumentscode) for Nextcloud since at least September 10, weeks before the issue received a CVE identifier or formal security bulletin.

The flaw, now tracked as CVE-2026-110447, affects richdocumentscode versions before 26.4.303. It resides in the mechanism Nextcloud uses to start the bundled Collabora server and can be triggered by sending a malicious request to the app’s proxy.php endpoint, resulting in OS command injection. No authentication or user interaction is required. Exploitation requires that the built-in CODE server be stopped, a state that can occur after a restart, upgrade, or crash.

Only the optional built-in CODE server app is affected. Standalone Collabora Online servers, Docker and RPM/DEB installations, and Nextcloud All-in-One deployments are not impacted.

Web Shells and Data Theft

Multiple administrators, including at least three who reported the activity on GitHub, said attackers planted PHP web shells on compromised servers and used them to search for password databases, password manager artifacts, and cryptocurrency wallets. Some users reported possible ransomware activity tied to the flaw, though this has not been independently confirmed.

A Monthlong Disclosure Gap

The fix for the vulnerability was committed on September 9, and version 26.4.303 shipped on September 11. A community warning urging immediate updates went out on October 3, but the formal advisory and CVE were not published until October 14, over a month after the patch was available.

Collabora attributed the delay primarily to backlogs in CVE processing, which it said are under strain from a growing volume of AI-driven vulnerability reports. Nextcloud said it learned of the issue from Collabora in mid-September, made an update available through its app store, and had not observed widespread exploitation at the time.

Research from Second Security cited alongside the reporting found that the median gap between public fixes and CVE publication for open-source flaws grew from 5.1 days in January to 39 days in August, a trend the firm links to AI-assisted vulnerability discovery straining CVE pipelines. In several cases examined, working exploit code appeared online within hours of a fix, days before the corresponding CVE existed, giving defenders little to search for by name.

Recommendations

  • Upgrade richdocumentscode to version 26.4.303 or later immediately.
  • Remove the Collabora Online Built-in CODE Server app if it is not required; Nextcloud warns that simply disabling it is not sufficient.
  • Check for unauthorized PHP web shells and review access logs for proxy.php requests dating back to September 10.
  • Audit for exposure of password managers and cryptocurrency wallet data on affected servers.