CVE-2026-110447: Hunt Collabora CODE Web Shells in Nextcloud

SOC & SIEM / INCIDENT RESPONSE

CISA has added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog. The flaw affects the optional Collabora Online Built-in CODE Server app for Nextcloud and can allow an unauthenticated request to execute an operating-system command as the web-server user when the bundled document server is not running. Administrators should treat an affected installation as both a patching priority and a possible incident.

What changed on October 23

Collabora published its GitHub security advisory for CVE-2026-110447 on October 14, 2026. CISA added the vulnerability to KEV on October 23, confirming that the issue meets the agency’s threshold for known exploitation. The public CVE record says the flaw was exploited in the wild during September and October 2026.

This is an operating-system command-injection vulnerability, classified as CWE-78. The vulnerable component is not Nextcloud Office in general and it is not every Collabora Online server. Scope depends on one specific deployment model: the optional Built-in CODE Server app, whose app identifier is richdocumentscode.

Why a stopped service can create exposure

The counterintuitive detail is that exploitation works while the built-in document server is not running. The app’s proxy path can attempt to start the local CODE process when a request arrives. In affected versions, externally influenced input can reach an operating-system command without adequate neutralization. A restart, upgrade, crash, or other period when the server is down can therefore open the vulnerable start path.

This also explains why toggling the app to “disabled” is not a complete mitigation. The vulnerable package remains on disk and can still leave exposed code paths depending on web-server routing and deployment details. The vendor’s supported choices are to update the Built-in CODE Server app to at least 26.4.303 or remove it. If platform compatibility prevents the update, do not improvise a version claim; remove the affected app or obtain vendor guidance.

Response sequence for Nextcloud administrators

Confirm the deployment model

First distinguish the built-in package from the regular Nextcloud Office integration. The identifiers are easy to confuse:

• richdocumentscode: the Built-in CODE Server app covered by CVE-2026-110447.
• richdocuments: the Nextcloud Office integration app, not the same package.
• A separate Collabora Online server: outside the vendor’s scope statement for this CVE, though normal patching still applies.

Use the supported Nextcloud command-line interface from the Nextcloud installation directory. The web-server account may differ from www-data on your platform.

sudo -E -u www-data php occ app:list --shipped false
sudo -E -u www-data php occ app:getpath richdocumentscode

# Show available updates without changing the instance
sudo -E -u www-data php occ app:update --showonly

If app:getpath fails because the app is not installed, record the evidence and verify that no abandoned directory remains in an alternate app path. If the app appears only under the disabled list, it still requires version review or removal.

Preserve evidence before cleanup

Where operationally feasible, preserve evidence before updating or removing files. Collect web access and error logs, Nextcloud logs, reverse-proxy and WAF events, authentication records, process telemetry, file timestamps, and outbound network records. Preserve the richdocumentscode directory as evidence instead of inspecting only the current state after an update.

install -d -m 0700 /var/tmp/cve-2026-110447-evidence

# Replace the source path with the value returned by occ app:getpath.
tar --xattrs --acls -czf /var/tmp/cve-2026-110447-evidence/richdocumentscode.tgz \
  /var/www/nextcloud/apps/richdocumentscode

sha256sum /var/tmp/cve-2026-110447-evidence/richdocumentscode.tgz \
  > /var/tmp/cve-2026-110447-evidence/SHA256SUMS.txt

Store evidence outside the web root and restrict access. The example archive path is temporary; transfer the evidence to the organization’s approved repository and document the collector, UTC time, source host, and hash.

Update or remove the affected app

After evidence collection and change approval, use the supported app-management command rather than manually editing version metadata:

sudo -E -u www-data php occ app:update richdocumentscode
sudo -E -u www-data php occ app:list --shipped false

# If the package is not required, remove it through occ.
sudo -E -u www-data php occ app:remove richdocumentscode

Choose either the update path or the removal path according to the service requirement. Do not run both blindly. Confirm that the resulting version is 26.4.303 or later when the app remains installed.

Detection and investigation guidance

The Nextcloud community warning reports that some administrators found web shells after exploitation. That observation should change the response from “install the patch and close the ticket” to “patch, preserve evidence, and determine whether attacker-controlled files or commands already ran.” A current fixed version does not establish that the historical exposure window was clean.

Run the built-in integrity check

Nextcloud provides an integrity command for installed apps. Run it after preserving the original directory. Unexpected or extra files are investigation leads, not automatic proof of compromise.

sudo -E -u www-data php occ integrity:check-app richdocumentscode

# Capture the result for the case record.
sudo -E -u www-data php occ integrity:check-app richdocumentscode \
  | tee /var/tmp/cve-2026-110447-evidence/integrity-check.txt

Correlate application, file, process, and network evidence

1. Search web logs for unusual requests to the Built-in CODE Server proxy path, then pivot to the same source, session, and time window.
2. Compare the app directory against trusted package contents and review files created or changed during suspicious requests.
3. Inspect process execution by the web-server account, especially shell interpreters, download utilities, archive tools, and unexpected child processes.
4. Review outbound connections and DNS requests from the Nextcloud host after suspicious activity.
5. Determine which configuration files, credentials, mounted shares, user data, and secrets the web-server identity could read.

Do not publish payload strings or replay suspicious requests against production. Investigation should use preserved logs and filesystem evidence. Teams using Suricata can apply the validation workflow in our Suricata EVE telemetry guide. If a web shell or unauthorized command is confirmed, use the containment and recovery sequence in our incident-response planning guide. Administrators should also verify the underlying PHP runtime using the PHP2Shell patching guide.

Hands-on lab: classify a Nextcloud inventory offline

This lab checks a synthetic CSV inventory without contacting a Nextcloud server. It distinguishes the affected Built-in CODE package from the separate Office integration and deliberately sends ambiguous versions to manual review.

Prerequisites

• Python 3.8 or later on an isolated analyst workstation or disposable virtual machine
• No production credentials, API tokens, or live server access
• App identifiers and versions collected through approved administrative channels

Create a synthetic inventory

mkdir -p collabora-inventory-lab && cd collabora-inventory-lab
cat > inventory.csv <<'CSV'
asset,app_id,version
cloud-a,richdocumentscode,26.4.302
cloud-b,richdocumentscode,26.4.303
cloud-c,richdocuments,8.6.5
cloud-d,richdocumentscode,unknown
CSV

Save the classifier

#!/usr/bin/env python3
import csv
import sys

FIXED = (26, 4, 303)

def version_tuple(value):
    parts = value.strip().split(".")
    if len(parts) != 3 or not all(part.isdigit() for part in parts):
        raise ValueError("expected three numeric components")
    return tuple(int(part) for part in parts)

def classify(app_id, version):
    if app_id != "richdocumentscode":
        return "NOT_IN_SCOPE", "not the Built-in CODE Server app"
    try:
        installed = version_tuple(version)
    except ValueError as exc:
        return "MANUAL_REVIEW", str(exc)
    if installed < FIXED:
        return "AFFECTED", "update to 26.4.303 or later, or remove the app"
    return "FIXED", "meets the vendor-published fixed-version floor"

with open(sys.argv[1], newline="", encoding="utf-8") as handle:
    for row in csv.DictReader(handle):
        state, note = classify(row["app_id"].strip(), row["version"].strip())
        print(f'{row["asset"]},{row["app_id"]},{row["version"]},{state},{note}')

Run the lab

python3 collabora_inventory_audit.py inventory.csv

# Expected output:
cloud-a,richdocumentscode,26.4.302,AFFECTED,update to 26.4.303 or later, or remove the app
cloud-b,richdocumentscode,26.4.303,FIXED,meets the vendor-published fixed-version floor
cloud-c,richdocuments,8.6.5,NOT_IN_SCOPE,not the Built-in CODE Server app
cloud-d,richdocumentscode,unknown,MANUAL_REVIEW,expected three numeric components

If Python reports an index error, confirm that the CSV contains asset, app_id, and version headers. A MANUAL_REVIEW result means the inventory is insufficient; it does not mean the host is safe. The example was executed locally against the synthetic rows shown above. It has not been tested against a production inventory export.

Remove the disposable lab files when finished:

cd ..
rm -rf -- collabora-inventory-lab

Post-remediation validation

1. Confirm that richdocumentscode is absent or at version 26.4.303 or later.
2. Re-run the Nextcloud integrity check and investigate every unexplained difference.
3. Verify document editing through the intended deployment model.
4. Review web-server account activity and outbound traffic across the available exposure window.
5. Rotate credentials and secrets accessible to the web-server identity when compromise is confirmed or cannot be reasonably excluded.
6. Record evidence gaps. Missing historical logs are uncertainty, not proof that exploitation did not occur.

If investigation finds unauthorized files, commands, or connections, isolate the host according to the organization’s incident-response plan and rebuild from a trusted state. Deleting one web shell is not equivalent to eradicating persistence. Preserve a clean separation between the evidence copy, analysis working copy, and restored production system.

Conclusion

CVE-2026-110447 is easy to mis-scope because the affected app, the regular Office integration, and standalone Collabora deployments have similar names. The defensible workflow is precise: identify richdocumentscode, preserve evidence, update to 26.4.303 or later or remove it, validate integrity, and investigate historical activity. CISA’s KEV addition makes current exposure an urgent operational risk, while the reported web-shell activity means patching should be paired with incident review.

Primary references

• Collabora security advisory GHSA-g3vx-3m76-fghh
• CISA Known Exploited Vulnerabilities Catalog
• CVE record for CVE-2026-110447
• NVD record for CVE-2026-110447
• Nextcloud community update warning
• Nextcloud administration documentation for app commands