Ethical Hacking News
A critical vulnerability in Collabora's built-in CODE app has exposed thousands of Nextcloud servers to potential hacking. The issue, known as "collabora-code," is a critical flaw in the app's proxy.php script that allows attackers to inject malicious commands into the server, potentially leading to unauthorized access and data breaches. To protect themselves, administrators are advised to update richdocumentscode to 26.4.303 or later, or remove the app. The vulnerability has been exploited in the wild since September and October 2026, and Collabora has released a fix for the issue.
Collabora's built-in CODE app has a critical vulnerability (dubbed "collabora-code") that exposes Nextcloud servers to potential hacking. The vulnerability was first reported on September 10 and was exploited multiple times in the following days. The issue allows attackers to inject malicious commands into the server, potentially leading to unauthorized access and data breaches. The vulnerability was present in all versions up to 26.4.303 and could also be exploited on standalone Collabora servers. Collabora has released a fix for the issue, which requires Nextcloud 30 or later, and recommends that users upgrade or remove the app. Administators are advised to monitor their access logs for suspicious activity and delete any potentially exposed files.
A recent vulnerability in Collabora's built-in CODE app has exposed thousands of Nextcloud servers to potential hacking, leaving many administrators scrambling to patch their systems before it's too late. The issue, which has been dubbed "collabora-code" by security researchers, is a critical flaw in the app's proxy.php script that allows attackers to inject malicious commands into the server, potentially leading to unauthorized access and data breaches.
The vulnerability was first reported by an administrator who hosts several Nextcloud servers and discovered that his servers had been hacked since September 10. The administrator, who wishes to remain anonymous, reported the issue on GitHub and provided access logs from two of his servers that show requests at 19:51 on September 10 and 09:56 on September 11 (UTC+2), both from one IP address and both aimed at proxy.php?status with a shell command hidden in the request path.
The attacker's payload was a one-line PHP web shell that decoded into a PHP script, which was stored in the app's folder. The script executed any command the attacker sent via a web request, with the rights of the web server account. The vulnerability was initially thought to be contained in version 26.4.302 of the app, but further investigation revealed that it was present in all versions up to 26.4.303.
The first logged attack on September 10 was followed by another attack on September 11, and subsequent attacks were reported by other administrators in the following days. However, Collabora fixed the issue in version 26.4.303 on September 11 and published an advisory with the identifier CVE-2026-110447 on October 14, warning that turning off the app does not help and that it must be updated or removed.
The advisory covers every version before 26.4.303 and states that standalone Collabora Online servers are not affected. However, the vulnerability is not specific to Nextcloud servers, as it can also be exploited on standalone Collabora servers. The app's proxy.php script starts the local CODE server whenever a request arrives, and nothing is listening. In versions up to 26.4.302, the script placed text from the request, including its path, inside a double-quoted bash command, where the shell still runs anything written as $(...).
This allowed an unauthenticated request to run a command on the server, but only when the app's local document server was not running, such as during a restart or upgrade, or after a crash. The script is a plain PHP file that the web server runs directly from the app's folder and loads none of Nextcloud's code.
In total, 12 administrators reported the vulnerability, and two of them discovered that the attackers had planted a web shell on their servers. The attackers used the web shell to search for credential stores and cryptocurrency wallets, including .kdbx, wallet.dat, and keystore.json files and names such as bitwarden, 1password, .bitcoin, .electrum, .monero, and .ethereum.
The attackers did not archive, upload, or copy out files, but anything the web server account can read must be treated as potentially exposed, according to one administrator. The vulnerability has been exploited in the wild since September and October 2026, and Collabora has released a fix for the issue.
According to Collabora, the fix requires Nextcloud 30 or later, and the app store still serves affected versions, so their users should upgrade Nextcloud or remove the app. The fixed version of the code change that closed the flaw is four lines in proxy.php. The start command is now handed to bash as a single escaped argument instead of a double-quoted string, so the shell that receives it no longer expands text from the request.
The repository's commit record shows the change was written on August 20 by Caolán McNamara, who also published the advisory, under the title "tidy up how the coolwsd launch command is built." It was not in version 26.4.302, released on August 31, and was committed on September 9. The first logged attack came on September 10, and 26.4.303 followed on September 11 with release notes that name only the bundled CODE build.
To protect themselves, administrators are advised to update richdocumentscode to 26.4.303 or later, or remove the app. On Nextcloud 29 or older, which cannot install 26.4.303, users should upgrade Nextcloud or remove the app. If an administrator has already updated, they should look for shx*.php files, starting in apps/richdocumentscode, and delete them. Then, they should check their access logs back to at least September 10 for proxy.php?status requests whose path contains %2e%2e, $(), or ${IFS}, and look for sudo attempts by the web server account.
Related Information:
https://www.ethicalhackingnews.com/articles/Hacking-into-Nextcloud-A-Critical-Flaw-in-Collaboras-Built-in-CODE-App-Exposes-Thousands-of-Servers-ehn.shtml
https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html
Published: Wed Oct 14 15:04:39 2026 by llama3.2 3B Q4_K_M
