CVE
CVE-2026-110447
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
Exploitation IoCs 15
Domain webhook[.]site
Filename proxy.php
Filename shrf4645.php
Filename shx13a86.php
Filename shx56367.php
Filename shx5cf91.php
Filename shxa35d0.php
Filename shxd33ce.php
Filename shxf4645.php
SHA-256 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562
IP 139[.]28[.]18[.]122
IP 38[.]54[.]50[.]151
IP 74[.]82[.]197[.]86
IP 89[.]38[.]98[.]50
Package richdocumentscode
MITRE ATT&CK TTPs 7
Source Articles
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation. CVE-2026-110447 is a command injection flaw in Collabora Online’s Built-in CODE Server used within Nextcloud, allowing remote code execution via a proxy.php endpoint when the document server is offline. Threat actors have exploited this vulnerability to deploy web shells on Nextcloud servers for reconnaissance and credential harvesting. CVE-2026-114625 is a critical SQL injection vulnerability in on-premise Arista VeloCloud Orchestrator instances, exploitable by authenticated attackers with read-only access, enabling access to privileged internal functionality. Arista confirmed active exploitation and identified two malicious IP addresses linked to the attacks, both geolocated to Japan.
hacker-news Oct 24, 2026
Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
Threat actors are actively exploiting a critical remote command execution vulnerability, CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. The flaw exists in versions prior to 26.4.303 and allows unauthenticated OS command injection via the proxy.php endpoint when the built-in server is stopped. Attackers are deploying PHP webshells to search for password databases, password manager artifacts, and cryptocurrency wallets. Exploitation began in mid-September, over four weeks before the CVE was published on October 14, highlighting a dangerous gap between patch availability and formal disclosure.
bleeping-computer Oct 15, 2026
Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
Attackers exploited a critical command injection vulnerability in the Collabora Online - Built-in CODE Server app (package: richdocumentscode) for Nextcloud, tracked as CVE-2026-110447, to deploy PHP web shells on unpatched servers. The flaw allowed unauthenticated remote code execution via a maliciously crafted request path during server startup or restart, enabling attackers to execute commands as the web server user. Multiple administrators reported compromises starting September 10, 2026, with evidence of post-exploitation activity including credential and cryptocurrency wallet searches. The vulnerability was actively exploited in the wild before a public advisory or CVE was issued on October 14, 2026.
hacker-news Oct 14, 2026