# Hackers Backdoor Nextcloud Servers via Command Injection in Collabora Online Built-in CODE Server (CVE-2026-110447)

> Attackers exploited an unauthenticated command injection in the richdocumentscode proxy.php of Collabora Online's Built-in CODE Server app for Nextcloud to drop PHP web shells on unpatched servers. The flaw is reachable only while the local CODE server process is down (restart, upgrade, crash); versions before 26.4.303 are affected.

- **Published:** 2026-10-14T19:33:46Z
- **Last reviewed:** 2026-10-14T19:33:46Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3542
- **ID:** TL-2026-3542
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-110447, CVE-2025-66208

## Description

The Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud ships a PHP proxy (proxy.php) that starts and relays requests to a local CODE document server. According to The Hacker News report, the root cause is that request-derived text was placed inside a double-quoted bash command string, so shell expansion (command substitution with $(...) and ${IFS}) of attacker-controlled path text was executed by the shell. Exploitation is possible only during the window in which the local CODE server is not running (restart, app upgrade, crash), because that is when proxy.php builds and runs the start command.

Exploit requests target /apps/richdocumentscode/proxy.php?status with the command hidden in the request path using URL-encoded dot-dot sequences (%2e%2e), $( ) or ${IFS} substitution, and a base64-encoded payload decoded and piped to a shell (base64 -d | sh). Observed payloads decoded PHP web shells into the apps/richdocumentscode/ directory. The dropped shell is a simple one-liner PHP shell accepting a GET parameter c (SHA-256 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562). Shell names observed: shrf4645.php, shxa35d0.php, shx5cf91.php, shxd33ce.php, shxf4645.php, shx13a86.php, shx56367.php.

Post-exploitation activity reported: attackers sent uname -a output to webhook.site endpoints (two webhook IDs reported), and searched for credential stores and wallets (*.kdbx, wallet.dat, keystore.json; .bitcoin, .electrum, .monero, .ethereum directories; bitwarden and 1password artifacts). The source reports no evidence of file exfiltration or root access. Because the shell runs as the web server account, all data readable by that account (including Nextcloud config and data) should be treated as potentially exposed.

Timeline per the source: fix code written August 20, 2026; version 26.4.302 (still vulnerable) released August 31; fix committed September 9; first logged attack September 10 (19:51 UTC+2); second attack and patch release (26.4.303) September 11; a third attempt against a patched server on September 14; community warning October 3; CVE and advisory published October 14, 2026. The issue was reported by GitHub user wwwshellcodeit and handled by Collabora (mmeeks). Related but distinct: CVE-2025-66208, an earlier richdocumentscode proxy.php command injection (CWE-78, fixed in 25.04.702, reverse-proxy X-Forwarded-Host dependent), whose fix does not prevent this attack. No threat actor has been attributed. Note: CVE-2026-110447 and the CVSS score could not be independently confirmed in NVD/search results during research; the details above rest primarily on the single cited news report and the GHSA-g3vx-3m76-fghh advisory it references (not retrievable at research time).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1505.003 Server Software Component: Web Shell
- T1140 Deobfuscate/Decode Files or Information
- T1027.010 Obfuscated Files or Information: Command Obfuscation
- T1082 System Information Discovery
- T1552.001 Unsecured Credentials: Credentials In Files
- T1555.005 Credentials from Password Stores: Password Managers
- T1071.001 Application Layer Protocol: Web Protocols
- T1102.002 Web Service: Bidirectional Communication

## Sources

- [Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora's Built-in CODE App](https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html)
- [CVE-2025-66208 - INCIBE-CERT early warning (related richdocumentscode command injection)](https://www.incibe.es/en/incibe-cert/early-warning/vulnerabilities/cve-2025-66208)
- [CVE-2025-66208 - Mend.io Vulnerability Database](https://www.mend.io/vulnerability-database/CVE-2025-66208/)
- [CVE-2025-66208 - OSV](https://osv.dev/vulnerability/CVE-2025-66208)
- [CVE-2025-66208 - Configuration-Dependent RCE in richdocumentscode proxy (CVElogic)](https://www.cvelogic.com/cve/CVE-2025-66208)
- [CVE-2025-66208 - vuln.today](https://vuln.today/cve/CVE-2025-66208)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3542