CVE

CVE-2026-110447

View on NVD ↗

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.

Exploitation IoCs 13

Domain webhook[.]site
Filename proxy.php
Filename shrf4645.php
Filename shx13a86.php
Filename shx56367.php
Filename shx5cf91.php
Filename shxa35d0.php
Filename shxd33ce.php
Filename shxf4645.php
SHA-256 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562
IP 139[.]28[.]18[.]122
IP 89[.]38[.]98[.]50
Package richdocumentscode

MITRE ATT&CK TTPs 4

T1005
Data from Local System
Collection
 T1059.003
Windows Command Shell
Execution
 T1190
Exploit Public-Facing Application
Initial Access
 T1566
Phishing
Initial Access

Source Articles

Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
Attackers exploited a critical command injection vulnerability in the Collabora Online - Built-in CODE Server app (package: richdocumentscode) for Nextcloud, tracked as CVE-2026-110447, to deploy PHP web shells on unpatched servers. The flaw allowed unauthenticated remote code execution via a maliciously crafted request path during server startup or restart, enabling attackers to execute commands as the web server user. Multiple administrators reported compromises starting September 10, 2026, with evidence of post-exploitation activity including credential and cryptocurrency wallet searches. The vulnerability was actively exploited in the wild before a public advisory or CVE was issued on October 14, 2026.
hacker-news Oct 14, 2026