Collabora CODE is on KEV. Disabling the Nextcloud app is not the fix.

CISA added CVE-2026-110447 on 23 October. Unauthenticated OS command injection in richdocumentscode proxy.php when the local CODE server is down. Floor is 26.4.303. Due Monday. Forensic triage Yes. Standalone Collabora is out of scope.

RWP Ventures · 2026-10-24 · event 2026-10-23 · 12 min read · priority 9.0

Do not collapse five facts.

1. This is not yesterday’s Arista row. The same catalog drop also added [CVE-2026-114625](/posts/2026-10-23-arista-velocloud-cve-2026-114625/) (VeloCloud Orchestrator, due 26 October, forensic triage Yes). That CVE was already yesterday’s Daily Top on vendor-confirmed exploitation. The overnight increment for VCO is the federal clock. 110447 is a different product, never a Daily Top, and unauthenticated.
2. Disable is not the close. Collabora’s advisory: it is not sufficient to disable the app; it must be upgraded to 26.4.303 or later, or removed. proxy.php is a plain PHP file the web server runs from the app tree. Nextcloud’s “disabled” flag does not stop that file from answering.
3. The window is when CODE is down. The injection is reachable without a login, but only while the built-in CODE server is not running — container restart, upgrade, crash. CVSS v4.0 9.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H). Attack Requirements Present is the vendor’s way of saying the server-down condition, not “hard to hit.”
4. 26.4.303 needs Nextcloud 30. Nextcloud 29 and older are end of life. The app store still serves them an affected build. Those hosts cannot take the named floor without a Nextcloud upgrade, or they remove the app. Collabora’s December 2025 fix for CVE-2025-66208 in the same script does not close this one.
5. This is not a PLC event and it is not PHP2Shell. Standalone Collabora Online servers are not affected. Nextcloud Office (richdocuments) without the built-in app is not affected. Docker / distro-package / hosted Collabora is not this CVE. [PHP2Shell](/posts/2026-10-22-php2shell-cve-2026-109618-109619/) is still off KEV; CISA’s 23 October update to the PHP alert still says it has not observed successful exploitation of 109618 / 109619.

The operator sentence: **inventory every Nextcloud for richdocumentscode, treat disable as still open, hunt shx*.php and extra PHP in the app tree before you call the version string clean, and do not close the ticket because you run Collabora in Docker.**

What happened

CISA published two one-CVE KEV alerts on 23 October. The -0 slug is CVE-2026-110447. Catalog count moved from 1754 (2026.10.21) to 1756. Both new rows carry forensicTriage Yes and due 26 October.

The CVE itself is older than the catalog row. MITRE published CVE-2026-110447 on 14 October. Collabora’s GitHub advisory GHSA-g3vx-3m76-fghh is the same day. The CVE text already said the flaw was exploited in the wild in September and October 2026, and that it is a different vulnerability than CVE-2025-66208.

Timeline that is in primary sources, not reconstructed:

The first reporter’s servers all ran 26.4.302. Payloads wrote one-line PHP webshells into the app directory and tried to send uname -a to webhook.site. On one host the shell was then used to search for credential and cryptocurrency artifacts (*.kdbx, wallet.dat, keystore.json, Bitwarden, 1Password, Bitcoin/Electrum/Monero/Ethereum paths). Reviewed HTTP logs in that report did not show archive or exfil commands. The reporter’s own conclusion, which we adopt: anything the web-server account can read is potentially exposed. No report in this retrieval shows root.

CISA’s catalog short description: the built-in CODE Server when used within the Nextcloud platform contains OS command injection that allows RCE when the CODE server isn’t running.

Why it matters

Three operational reasons this is the daily.

First, the app is optional and still internet-reachable. richdocumentscode is listed for local testing, personal use, and small teams. That is not the same as “not in production.” A Nextcloud that faces the internet and has the app installed is the asset. Asset registers that only store “we use Nextcloud Office” or “Collabora is Docker” will miss it.

Second, the close conditions are easy to get wrong. Disable leaves proxy.php on disk. Nextcloud 29 cannot install 26.4.303. 26.4.402 is a later build, not the advisory floor, and is reported to break document open on some setups. CVE-2025-66208 is a previous command-injection in the same script; treating that patch as this close is a third false green.

Third, KEV plus forensic triage changes the ticket type. FCEB due is Monday 26 October. BOD 26-04 wants a check for compromise before the patch is treated as the end of the work. That matches what operators already found: leftover shx*.php after 26.4.303, and at least one Nx_33143.php that integrity flagged after an upgrade. A current version string is not a clean box.

Who / what is affected

• Affected (vendor): Collabora Online – Built-in CODE Server (richdocumentscode) before 26.4.303, on Nextcloud. Every version before that floor, per GHSA.
• Fixed: 26.4.303 and later. Fixed builds require Nextcloud 30 or later.
• Not affected (vendor / community, consistent): standalone Collabora Online servers; Nextcloud Office (richdocuments) without the built-in app installed; Collabora run in Docker, from a Linux package, or as hosted CODE (examples named on the forum: IONOS, Hostinger, Cloud42).
• Nextcloud 29 and older: cannot take 26.4.303. Upgrade Nextcloud or remove the app. “Disabled on EOL Nextcloud” is still open.
• Prerequisite: unauthenticated HTTP to proxy.php and the local CODE process not listening. No user interaction. No Nextcloud session.
• OT / ICS: UNKNOWN for process impact. This is a document-preview helper on a file-share. Do not merge it with Siemens Software Center, WAGO, or a plant historian.

Technical context

High-level, from GHSA-g3vx-3m76-fghh, the CVE record, and operator reports. This is not an exploit recipe.

proxy.php starts the local CODE process when a request arrives and nothing is listening. In builds through 26.4.302, request text — including the path — was placed inside a double-quoted bash command, where the shell still expands $(...). Because the script only builds that command when it needs to start CODE, the path is live while CODE is down. The file is ordinary PHP in the app folder. It does not load Nextcloud’s auth stack.

The four-line change that closed it hands the start command to bash as a single escaped argument, so request text is no longer expanded. Collabora scores CVSS v4.0 9.2 with AT:P. CWE-78.

Observed post-exploit, from operator logs, not a complete playbook:

• Webshells under apps/richdocumentscode/, names **shx.php / shrf.php, plus at least Nx_33143.php**
• One recovered sample SHA-256: 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562 (one-line GET-parameter command runner)
• Source IPs 139.28.18.122 (10–11 Sep) and 89.38.98.50 (14 Sep attempt on a patched host)
• Callbacks to webhook.site (IDs 45060ed4-de0b-4119-8f0d-2a2776bbd413, 774cf5e1-b5a4-4174-a1ad-0241861029a2)
• Request markers in the path: %2e%2e, $(, ${IFS}, base64 piped to sh
• Endpoint: /apps/richdocumentscode/proxy.php?status

ATT&CK (defensive mapping, not attribution): T1190 exploit public-facing application; T1059 command and scripting interpreter; T1505.003 web shell. Actor identity: UNKNOWN. Ransomware use: UNKNOWN (CISA catalog). Named victim census: UNKNOWN. Root: not shown.

RWP is not publishing the encoded path, the bash substitution, or a how-to for the injection.

Threat / exploitation status

Collabora, GHSA, 14 October: “It is not sufficient to disable the app to avoid the problem; it must be upgraded to >= 26.4.303 or removed.”

What defenders should do

1. Inventory Nextcloud for richdocumentscode, including hosts that “only used it for testing.” Check the app list and the on-disk tree apps/richdocumentscode. A Docker Collabora sidecar is a different question. An installed built-in app is this CVE.
2. Upgrade to 26.4.303 or later, or remove the app. Disable is not remove. Nextcloud 29 and older: upgrade Nextcloud first, or remove the app. Do not treat 26.4.402 as required; the advisory floor is 26.4.303. If 26.4.402 fails to start CODE on your build, stay on 26.4.303 until Collabora says otherwise — but only after the hunt in step 3.
3. Hunt before you declare clean. Integrity extra-file hits in richdocumentscode. Names **shx.php, shrf.php, Nx_33143.php, and any other unexpected PHP under that tree. Delete leftovers after you image or copy them. Hash 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562** is one sample, not the only possible implant.
4. Logs back to at least 10 September 2026. proxy.php?status with %2e%2e, $(, ${IFS}, or base64 in the path. Source IPs 139.28.18.122 and 89.38.98.50. Outbound to webhook.site. sudo failures from the web-server account. Absence of those two IPs is not a miss on the class.
5. If you find a shell or a matching request, treat it as an incident. Rotate secrets the web-server account could read (database password, app passwords, object-storage keys). Do not assume no exfil because the published logs did not show a tar. BOD 26-04 forensic triage is Yes on this row.
6. FCEB clock is Monday 26 October. Private-sector operators should not wait for that date. The exploitation window in the CVE is already September.
7. Do not close adjacent tickets on this CVE. [VeloCloud 114625](/posts/2026-10-23-arista-velocloud-cve-2026-114625/) is the other 23 October KEV row — on-prem floors 5.2.3.18 / 6.1.3.10 / 6.4.2.12, Hosted already patched. [Plex 96654 / 96656](/posts/2026-10-21-plex2shell-kev-assume-compromise/) and SiteGuard 106931 were due 23 October. PHP2Shell is still the interpreter, still off KEV.

RWP assessment

High confidence that CVE-2026-110447 is unauthenticated OS command injection in Nextcloud’s built-in Collabora CODE app, that the floor is 26.4.303, that disable does not close it, that standalone / Docker / packaged Collabora are out of scope, and that CISA added the row on 23 October to catalog 2026.10.23 / 1756 with due 26 October and forensic triage Yes.

High confidence in exploitation in September–October 2026 as a class: it is in the CVE text, in multiple independent operator reports, and now in KEV. That is not a victim census.

Moderate confidence that the published shx / shrf family plus Nx_33143.php is what defenders should hunt first. Filenames rotate. Integrity extra-file is the durable check.

Low confidence in actor identity, dwell, successful theft of the credential/wallet files that were searched, and ransomware overlay. None of those is in the KEV row.

Confidence that this is not OT process impact: high. No evidence in this retrieval that a controller, safety system, or physical process was affected.

This outranked the rest of the window because it is a new product on KEV, unauthenticated RCE, forensic triage Yes, due Monday, with a built-in false close (disable) and a second false close (EOL Nextcloud that cannot take 26.4.303). Arista’s KEV add is material but is yesterday’s CVE. HPE’s eight CVSS 10 ArubaOS bugs have no claimed in-the-wild use. GitLab CVE-2026-110264 remains CVSS 10 without confirmed exploitation. PHP CVE-2026-115560 is a narrow, unpatched session-upload-progress path that PHP is putting in the regular cycle. Quest’s Quanum LSM incident is a healthcare records event without a CVE in this retrieval.

What we are watching

• Whether 26.4.402 (or a later 26.4.x) becomes the advised floor once start failures are closed.
• A named census, a second webshell family beyond shx / Nx_, or ransomware use flipping off Unknown.
• Whether CISA adds [PHP2Shell 109618 / 109619](/posts/2026-10-22-php2shell-cve-2026-109618-109619/). Catalog still has neither. CISA’s 23 October PHP-alert update still reports no successful exploitation observed.
• On-prem VeloCloud 114625 now on the same Monday due as this row. Hunt the two Arista IPs; do not stop at September’s 5.2.3.16 / 6.4.2.8.
• HPE HPESBNW05162 (22 October): 72 ArubaOS issues, eight scored 10.0, no public exploit or exploitation claimed in the bulletin we have. Patch, restrict management planes; not KEV.
• GitLab CVE-2026-110264 (unauthenticated regex-compiler RCE, CVSS 10, self-managed from 7.0). No confirmed in-the-wild use in this retrieval. October 12 regex builds do not close it.
• PHP CVE-2026-115560: keep session.upload_progress.enabled=0 until the next regular PHP release if you already set it for 109619. Not an emergency build.
• Quest Diagnostics Quanum LSM unauthorized access (learned 21 October, 8-K 22 October). PHI accessed: REPORTED by the company; scope still under investigation. Not this CVE.

Sources

Primary: CISA KEV JSON catalog 2026.10.23 / 1756; CISA 23 October alert for CVE-2026-110447; Collabora GHSA-g3vx-3m76-fghh (14 October); CVE-2026-110447 / NVD; GitHub issue 354; Nextcloud community thread 3–16 October. Independent: The Hacker News 14 October. Adjacent, not this story: CISA 23 October alert for CVE-2026-114625; CISA PHP alert updated 23 October; PHP informational advisory CVE-2026-115560; HPE HPESBNW05162; GitLab CVE-2026-110264; Quest Quanum notice. Prior RWP: Arista VeloCloud Daily Top 23 October; PHP2Shell Daily Top 22 October; Plex2Shell Daily Top 21 October.