Threat reportVulnerabilityTL-2026-3542
Hackers Backdoor Nextcloud Servers via Command Injection in Collabora Online Built-in CODE Server (CVE-2026-110447)
Hackers Backdoor Nextcloud Servers via Command Injection in (TL-2026-3542) is a critical-severity software vulnerability, first published 2026-10-14. It has no confirmed attribution, affects Collabora Collabora Online - Built-in CODE Server (richdocumentscode), references 2 CVEs (CVE-2026-110447, CVE-2025-66208), maps to 10 MITRE ATT&CK techniques (T1027.010, T1059.004, T1071.001), and is covered by 9 detection rules and 16 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 10MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-3542
- Threat ID
- TL-2026-3542
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, government administration, education, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 16
How Hackers Backdoor Nextcloud Servers via Command Injection in works
Attackers exploited an unauthenticated command injection in the richdocumentscode proxy.php of Collabora Online's Built-in CODE Server app for Nextcloud to drop PHP web shells on unpatched servers. The flaw is reachable only while the local CODE server process is down (restart, upgrade, crash); versions before 26.4.303 are affected.
The Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud ships a PHP proxy (proxy.php) that starts and relays requests to a local CODE document server. According to The Hacker News report, the root cause is that request-derived text was placed inside a double-quoted bash command string, so shell expansion (command substitution with $(...) and ${IFS}) of attacker-controlled path text was executed by the shell. Exploitation is possible only during the window in which the local CODE server is not running (restart, app upgrade, crash), because that is when proxy.php builds and runs the start command.
Exploit requests target /apps/richdocumentscode/proxy.php?status with the command hidden in the request path using URL-encoded dot-dot sequences (%2e%2e), $( ) or ${IFS} substitution, and a base64-encoded payload decoded and piped to a shell (base64 -d | sh). Observed payloads decoded PHP web shells into the apps/richdocumentscode/ directory. The dropped shell is a simple one-liner PHP shell accepting a GET parameter c (SHA-256 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562). Shell names observed: shrf4645.php, shxa35d0.php, shx5cf91.php, shxd33ce.php, shxf4645.php, shx13a86.php, shx56367.php.
Post-exploitation activity reported: attackers sent uname -a output to webhook.site endpoints (two webhook IDs reported), and searched for credential stores and wallets (*.kdbx, wallet.dat, keystore.json; .bitcoin, .electrum, .monero, .ethereum directories; bitwarden and 1password artifacts). The source reports no evidence of file exfiltration or root access. Because the shell runs as the web server account, all data readable by that account (including Nextcloud config and data) should be treated as potentially exposed.
Timeline per the source: fix code written August 20, 2026; version 26.4.302 (still vulnerable) released August 31; fix committed September 9; first logged attack September 10 (19:51 UTC+2); second attack and patch release (26.4.303) September 11; a third attempt against a patched server on September 14; community warning October 3; CVE and advisory published October 14, 2026. The issue was reported by GitHub user wwwshellcodeit and handled by Collabora (mmeeks). Related but distinct: CVE-2025-66208, an earlier richdocumentscode proxy.php command injection (CWE-78, fixed in 25.04.702, reverse-proxy X-Forwarded-Host dependent), whose fix does not prevent this attack. No threat actor has been attributed. Note: CVE-2026-110447 and the CVSS score could not be independently confirmed in NVD/search results during research; the details above rest primarily on the single cited news report and the GHSA-g3vx-3m76-fghh advisory it references (not retrievable at research time).
MITRE ATT&CK techniques used in TL-2026-3542
Defense Evasion
T1027.010 Obfuscated Files or Information: Command Obfuscation; T1140 Deobfuscate/Decode Files or Information
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1102.002 Web Service: Bidirectional Communication
Discovery
T1082 System Information Discovery
Initial Access
T1190 Exploit Public-Facing Application
Persistence
T1505.003 Server Software Component: Web Shell
Credential Access
T1552.001 Unsecured Credentials: Credentials In Files; T1555.005 Credentials from Password Stores: Password Managers
Affected products and versions in Hackers Backdoor Nextcloud Servers via Command Injection in
- Collabora — Collabora Online - Built-in CODE Server (richdocumentscode) for Nextcloud
Vulnerable versions: < 26.4.303
Fixed in: 26.4.303 - Nextcloud — Nextcloud (29 and older cannot install the patched app version)
Vulnerable versions: 29 and earlier with richdocumentscode < 26.4.303
Fixed in: 30 or later with richdocumentscode 26.4.303
Remediation for Hackers Backdoor Nextcloud Servers via Command Injection in
Patches
- richdocumentscode 26.4.303 (released 2026-09-11) requires Nextcloud 30 or later
Immediate actions
- Update richdocumentscode (Collabora Online - Built-in CODE Server) to 26.4.303 or later, or remove the app
- Search web/proxy logs from 2026-09-10 onward for proxy.php?status requests containing %2e%2e, $( or ${IFS}
- Delete any shx*.php files from apps/richdocumentscode/ and investigate how they were created
- Block 139.28.18.122 and 89.38.98.50 and review egress to webhook.site
- Treat all data readable by the web server account as potentially exposed; rotate credentials and secrets accessible to it
Workarounds
- Remove or disable the Built-in CODE Server app if it cannot be updated
- Nextcloud 29 and older cannot install the fixed app version: upgrade Nextcloud or remove the app
Longer-term hardening
- Monitor for sudo attempts and unexpected child processes (sh, base64) spawned by the web server account
- Run Nextcloud web server account with least privilege and restrict PHP write access to app directories
- Alert on new PHP files created under Nextcloud apps directories
CVEs associated with Hackers Backdoor Nextcloud Servers via Command Injection in
Weaknesses (CWE) in Hackers Backdoor Nextcloud Servers via Command Injection in
Timeline of Hackers Backdoor Nextcloud Servers via Command Injection in
- Security fix code for the proxy.php command injection written without an accompanying security notice
- richdocumentscode 26.4.302 released and remains vulnerable
- Fix committed to the richdocumentscode repository (4-line change in proxy.php)
- First logged exploitation attempt from 139.28.18.122 (19:51 UTC+2)
- richdocumentscode 26.4.303 released; second attack logged earlier the same day (09:56 UTC+2)
- Third attack attempt from 89.38.98.50 against an already patched server
- Community warning issued about exploitation of the Built-in CODE Server app
- CVE-2026-110447 and advisory GHSA-g3vx-3m76-fghh published; The Hacker News reports web shell deployments
Sources cited for Hackers Backdoor Nextcloud Servers via Command Injection in
- Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora's Built-in CODE App
- CVE-2025-66208 - INCIBE-CERT early warning (related richdocumentscode command injection)
- CVE-2025-66208 - Mend.io Vulnerability Database
- CVE-2025-66208 - OSV
- CVE-2025-66208 - Configuration-Dependent RCE in richdocumentscode proxy (CVElogic)
- CVE-2025-66208 - vuln.today
Detection coverage for TL-2026-3542
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3542 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.