Nextcloud + Collabora CODE: A Textbook Race-Condition Web Shell Nightmare

As reported by The Hacker News, attackers have actively exploited a critical command-injection flaw in Collabora's Built-in CODE Server app for Nextcloud to deploy web shells. What makes this story noteworthy isn't just the vulnerability—it's the collision of three systemic problems: a "testing-only" tool used in production, a race condition that exploits the exact moments defenders let their guard down, and an incomplete prior fix that left a sibling attack path open.

Vulnerability Details

Identifier	CVE-2026-110447
Severity	Critical (unauthenticated remote command execution)
Affected Product	Collabora Online - Built-in CODE Server (richdocumentscode) for Nextcloud, all versions < 26.4.303
Root Cause	Command injection in `proxy.php` via unsanitized request path inserted into double-quoted bash command; `$(...)` substitution executes attacker-controlled commands as the web server user
Exploitation Window	Only when local CODE server is not listening (restart, upgrade, crash, container spin-up)
Patch Status	Fixed in version 26.4.303 (released September 11, 2026); requires Nextcloud 30+
Active Exploitation	Yes — first observed September 10, 2026; multiple administrators reported web shell deployment
Related CVE	CVE-2025-66208 (prior command-injection in same script; fix does NOT prevent this flaw)

Why This Matters Beyond the CVE

The attack surface here is deceptively narrow but disproportionately dangerous. The richdocumentscode package bundles Collabora's CODE edition directly into the Nextcloud web root—meaning the web server user can execute arbitrary shell commands. When an attacker plants a web shell through this vector, they inherit the full permissions of that account. In most Nextcloud deployments, that's www-data or equivalent, which typically has read access to the Nextcloud data directory, database credentials in config.php, and potentially the ability to pivot to other services on the host.

The irony is brutal: the vulnerability only triggers when the CODE server is down—during a restart, upgrade, or crash. Attackers are weaponizing the precise moments when monitoring alerts are noisiest and human attention is most fragmented.

Equally concerning is the app store distribution model. Collabora explicitly labels richdocumentscode as "for local testing and non-production use" and "for personal use or for small teams." Yet many SMBs and homelab operators deploy it because it eliminates the operational overhead of running a separate Collabora instance. Nextcloud 29 and earlier—now end-of-life—can still download the vulnerable version from the app store, creating a persistent long-tail of exposed installations.

The Incomplete-Fix Problem

CVE-2025-66208, disclosed last December, was a separate command-injection flaw in the same proxy.php script. That fix did not prevent CVE-2026-110447. This is a recurring pattern: patches that close one injection vector while leaving adjacent syntactic sinks untouched. Defenders should assume that any script mixing PHP string interpolation with shell execution has multiple latent injection paths and audit accordingly.

Who Is Most Exposed

SMBs and small teams using the built-in CODE app instead of a standalone Collabora server (the intended-but-ignored warning label)

Homelab and self-hosted Nextcloud instances running on shared hosting or single-VM deployments where the web server user has broad filesystem access

Nextcloud 29 and older deployments that are EOL but can still install the vulnerable app version

Containerized deployments where restarts are frequent and automated, widening the exploitation window

Shield53 Recommendations

Immediate Actions

Patch or remove the app. Upgrade richdocumentscode to 26.4.303 or later. If you cannot patch (Nextcloud < 30), remove the app entirely—disabling it is insufficient.
Hunt for web shells. Search the Nextcloud web root and app directories for unexpected .php files, particularly in apps/richdocumentscode/ and writable upload paths. Look for files with recent modification timestamps around September 10 onward.
Rotate credentials. If the app was present and the server has restarted since September 10, assume compromise. Rotate database credentials in config.php, Nextcloud admin passwords, and any secrets stored in the data directory.
Review web server logs for requests to proxy.php with suspicious path components (encoded $(...) patterns, backticks, or semicolons in URIs).

Strategic Hardening

Migrate off the built-in CODE app to a standalone Collabora Online server (Docker, Linux package, or hosted). This eliminates the proxy.php attack surface entirely.
Upgrade Nextcloud to 30+ if still on 29 or older. EOL versions will continue receiving vulnerable app versions from the store.
Constrain the web server user. Use AppArmor or SELinux profiles to restrict www-data filesystem access. Run Nextcloud in a container with read-only mounts for the app directory where possible.
Deploy a WAF rule blocking requests to proxy.php containing shell metacharacters ($, (, ), backticks, ;, |) as a virtual patch for systems that cannot immediately upgrade.

This incident is a reminder that "optional" and "testing-only" labels in app ecosystems are advisory, not enforceable. When a tool is one click away in an app store, usage intent diverges rapidly from documentation. Security teams should treat any bundled component that executes shell commands with web-tier input as a tier-1 risk, regardless of its labeling.