{"slug":"nextcloud-collabora-code","title":"Nextcloud Collabora CODE (CVE-2026-110447)","shortName":"Collabora CODE","summary":"Unauthenticated OS command injection in the Collabora Online Built-in CODE Server Nextcloud app (richdocumentscode). A request to proxy.php can run a command as the web server user while the built-in CODE server is down. CVSS v4 9.2. Exploited in the wild from 10 Sep 2026. CISA KEV added 23 Oct 2026.","isExample":false,"draft":false,"family":"nextcloud-collabora-code","kind":"shared-component","aliases":["CVE-2026-110447","richdocumentscode","Collabora Online Built-in CODE Server"],"publishedAt":"2026-10-14","updatedAt":"2026-10-24","patchStatus":"patched","exploited":true,"scores":{"cve":"CVE-2026-110447","cvss":{"cve":"CVE-2026-110447","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","scorer":"cna","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110447","sourceDate":"2026-10-24","checkedDate":"2026-10-24"},"epss":{"cve":"CVE-2026-110447","score":0.01225,"percentile":0.68615,"date":"2026-10-23","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110447","checkedDate":"2026-10-24"},"kev":{"cve":"CVE-2026-110447","listed":true,"dateAdded":"2026-10-23","dueDate":"2026-10-26","catalogVersion":"2026.10.23","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-10-24"},"addedDate":"2026-10-24"},"priority":{"label":"act-now"},"managementSummary":{"what":"Unauthenticated command injection in the Collabora built-in CODE Nextcloud app (CVE-2026-110447). Exploited from 10 Sep 2026 and added to CISA KEV on 23 Oct 2026.","action":"Upgrade richdocumentscode to 26.4.303 or remove the app, then hunt proxy.php requests back to 10 Sep 2026."},"seenInTheWild":[{"metric":"exploitation-confirmed","value":"Listed","observer":"CISA","date":"2026-10-23","method":"CISA KEV catalog 2026.10.23, dateAdded 2026-10-23, due 2026-10-26","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"},{"metric":"exploitation-confirmed","value":"Exploited in the wild in September and October 2026","observer":"CVE Program","date":"2026-10-14","method":"CVE record description (updated 2026-10-14)","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110447"},{"metric":"exploitation-confirmed","value":"Webshells planted on Nextcloud hosts running richdocumentscode 26.4.302","observer":"Administrators on GitHub issue 354","date":"2026-09-10","method":"Access logs and integrity-check reports posted by admins","sourceUrl":"https://github.com/CollaboraOnline/richdocumentscode/issues/354"}],"seenInTheWildLinks":[],"whatChanged":{"date":"2026-10-24","items":[{"text":"CISA added CVE-2026-110447 to KEV on 23 Oct 2026 (due 26 Oct; ransomware use Unknown).","section":"exploitation","sourceUrl":"https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0"},{"text":"Collabora GHSA: unauthenticated command injection in richdocumentscode; fixed in 26.4.303.","section":"overview","sourceUrl":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh"},{"text":"Admin reports from 10 Sep 2026; CVE record says exploited in September and October.","section":"exploitation","sourceUrl":"https://github.com/CollaboraOnline/richdocumentscode/issues/354"},{"text":"Ransomware use reported by users, unconfirmed. KEV lists KnownRansomwareCampaignUse as Unknown.","section":"exploitation","sourceUrl":"https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/"},{"text":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected"},{"text":"Act-now priority block with sourced CVSS, EPSS, and CISA KEV dates.","section":"priority","addedDate":"2026-10-24"},{"text":"Detection rule coverage table and JSON, IOC CSV, and STIX feeds.","section":"detection","addedDate":"2026-10-24"}]},"whatTheBugIs":"CVE-2026-110447 is an unauthenticated OS command injection (CWE-78) in Collabora Online Built-in CODE Server, the optional Nextcloud app published as richdocumentscode. Collabora published GitHub advisory GHSA-g3vx-3m76-fghh on 14 Oct 2026 and rates it Critical, CVSS v4 9.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).\n\nA request to the app's proxy.php can cause an operating system command to run as the web server user. The attack only works while the built-in CODE server is not running, for example after a container restart, an upgrade, or a crash. Disabling the app is not enough. Collabora says the app must be upgraded to 26.4.303 or later, or removed.\n\nAffected versions are richdocumentscode before 26.4.303. The patched release is 26.4.303. Users of end-of-life Nextcloud 29 and older should upgrade Nextcloud or remove the app. Standalone Collabora Online servers are not affected (vendor statement).\n\nThis is not the same path as CVE-2025-66208. Collabora says the fix for that issue does not prevent this one.\n\nThe CVE record, updated 14 Oct 2026, says the flaw was exploited in the wild in September and October 2026. Administrators first posted access logs of successful attacks on 10 and 11 Sep 2026 against hosts running 26.4.302.","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"reach","label":"Unauthenticated request","detail":"A network request reaches the Nextcloud app without a login."},{"id":"app","label":"CODE server down","detail":"proxy.php handles the request while the built-in CODE server is not running (restart, upgrade, or crash)."},{"id":"exploit","label":"Command injection","detail":"Text from the request is used in an OS command. Conceptual impact class only."},{"id":"exec","label":"Code exec","detail":"The command runs as the web server user. Admins reported PHP webshells in the app folder."}]},"exploitation":{"kev":{"listed":true,"date":"2026-10-23","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"CISA KEV catalog 2026.10.23 (released 2026-10-23T19:30:18Z, 1,756 entries). CVE-2026-110447 added 2026-10-23, due 2026-10-26. knownRansomwareCampaignUse Unknown. Checked 24 Oct 2026."},"firstSeen":{"date":"2026-09-10","source":"GitHub issue CollaboraOnline/richdocumentscode#354","note":"An administrator posted access logs showing requests at 10 Sep 2026 19:51 (+0200) and 11 Sep 2026 09:56 (+0200) from 139.28.18.122 to /apps/richdocumentscode/proxy.php?status on servers running 26.4.302. The CVE record says exploited in the wild in September and October 2026."},"vendorStatements":[{"vendor":"Collabora","date":"14 Oct 2026","statement":"Users of Nextcloud with Collabora Online - Built-in CODE Server app can be vulnerable through proxy.php. A request can cause an operating system command to run as the web server user. The attack only works while the built-in CODE server is not running. It is not sufficient to disable the app. Standalone Collabora Online servers are not affected.","url":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh","retracted":false},{"vendor":"CISA","date":"23 Oct 2026","statement":"CISA added CVE-2026-110447 Collabora Online Built-in CODE Server OS Command Injection Vulnerability to the KEV catalog, based on evidence of active exploitation. knownRansomwareCampaignUse Unknown. Due 26 Oct 2026.","url":"https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0","retracted":false},{"vendor":"CVE Program","date":"14 Oct 2026","statement":"Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode) allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208.","url":"https://www.cve.org/CVERecord?id=CVE-2026-110447","retracted":false}]},"timeline":[{"date":"2026-09-10T17:51:52Z","event":"An administrator later posted access logs showing a request at 10 Sep 2026 19:51 (+0200) from 139.28.18.122 to /apps/richdocumentscode/proxy.php?status on a host running 26.4.302.","source":{"title":"Security issue - Hack (#354)","url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","publisher":"GitHub / HeikoBw"},"kind":"exploited","key":true,"addedDate":"2026-10-24"},{"date":"2026-09-11T07:56:21Z","event":"A second logged request from the same IP at 11 Sep 2026 09:56 (+0200) hit proxy.php?status on another 26.4.302 host.","source":{"title":"Security issue - Hack (#354)","url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","publisher":"GitHub / HeikoBw"},"kind":"exploited","addedDate":"2026-10-24"},{"date":"2026-09-11T14:53:46Z","event":"GitHub issue CollaboraOnline/richdocumentscode#354 'Security issue - Hack' opened. The reporter described planted PHP files matching shx*.php and outbound callbacks to webhook.site.","source":{"title":"Security issue - Hack (#354)","url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","publisher":"GitHub / HeikoBw"},"kind":"disclosure","key":true,"addedDate":"2026-10-24"},{"date":"2026-09-11","event":"richdocumentscode 26.4.303 shipped, the version Collabora later names as the fix. The Hacker News and BleepingComputer both date this release 11 Sep 2026.","source":{"title":"Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora's Built-in CODE App","url":"https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html","publisher":"The Hacker News"},"kind":"patch","key":true,"addedDate":"2026-10-24"},{"date":"2026-09-11","event":"A second administrator commented that Nextcloud's integrity check flagged a planted PHP file named shx13a86.php.","source":{"title":"Security issue - Hack (#354) comment","url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","publisher":"GitHub / UlliDieckmann"},"kind":"exploited","addedDate":"2026-10-24"},{"date":"2026-09-14","event":"Collabora's mmeeks said the issue impacts the Development Edition in Built-in CODE Server mode and told users to upgrade. He later confirmed 26.4.303 should be good.","source":{"title":"Security issue - Hack (#354) comments","url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","publisher":"GitHub / mmeeks"},"kind":"vendor","addedDate":"2026-10-24"},{"date":"2026-09-14T17:04:11Z","event":"UlliDieckmann posted a follow-up request at 14 Sep 2026 19:04 (+0200) from 89.38.98.50 against proxy.php?status after upgrading to 26.4.303.","source":{"title":"Security issue - Hack (#354) comment","url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","publisher":"GitHub / UlliDieckmann"},"kind":"exploited","addedDate":"2026-10-24"},{"date":"2026-09-18","event":"mmeeks said it is important to upgrade to 26.4.303 and to remove lingering shx*.php files.","source":{"title":"Security issue - Hack (#354) comment","url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","publisher":"GitHub / mmeeks"},"kind":"vendor","addedDate":"2026-10-24"},{"date":"2026-09-29","event":"A commenter wrote that threat actors and ransomware operators had started to abuse the flaw. This remains a user report. BleepingComputer later could not confirm ransomware use. CISA KEV lists ransomware use as Unknown.","source":{"title":"Security issue - Hack (#354) comment","url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","publisher":"GitHub / nembo81"},"kind":"other","addedDate":"2026-10-24"},{"date":"2026-10-03T08:47:52Z","event":"Nextcloud community forum post 'To Collabora Built-in User: Update ASAP' warned that richdocumentscode 26.4.302 and older were being exploited and that no CVE had been published yet.","source":{"title":"To Collabora Built-in User: Update ASAP","url":"https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516","publisher":"Nextcloud community forum"},"kind":"advisory","key":true,"addedDate":"2026-10-24"},{"date":"2026-10-14","event":"Collabora published GHSA-g3vx-3m76-fghh (Critical, CVSS v4 9.2) for unauthenticated OS command injection in the richdocumentscode proxy. Affected: richdocumentscode before 26.4.303. Patched: 26.4.303.","source":{"title":"Unauthenticated OS command injection in the richdocumentscode proxy","url":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh","publisher":"Collabora"},"kind":"advisory","key":true,"addedDate":"2026-10-24"},{"date":"2026-10-14","event":"CVE-2026-110447 published (updated 2026-10-14). CWE-78. The record says exploited in the wild in September and October 2026.","source":{"title":"CVE Record: CVE-2026-110447","url":"https://www.cve.org/CVERecord?id=CVE-2026-110447","publisher":"CVE Program"},"kind":"disclosure","key":true,"addedDate":"2026-10-24"},{"date":"2026-10-14","event":"The Hacker News reported the advisory and said 26.4.303 shipped 11 Sep 2026. Fixed versions require Nextcloud 30 or later.","source":{"title":"Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora's Built-in CODE App","url":"https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html","publisher":"The Hacker News"},"kind":"other","addedDate":"2026-10-24"},{"date":"2026-10-15","event":"BleepingComputer reported attacks from mid-September, webshells used to search for password databases, password-manager artifacts and crypto wallets, and that some users reported ransomware operators exploiting it (unconfirmed).","source":{"title":"Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers","url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/","publisher":"BleepingComputer"},"kind":"other","addedDate":"2026-10-24"},{"date":"2026-10-23","event":"CISA added CVE-2026-110447 to the KEV catalog (catalog 2026.10.23, released 2026-10-23T19:30:18Z, 1,756 entries). Due 2026-10-26. knownRansomwareCampaignUse Unknown.","source":{"title":"Known Exploited Vulnerabilities Catalog (JSON feed)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"kev","key":true,"addedDate":"2026-10-24"},{"date":"2026-10-23","event":"CISA published the alert 'CISA Adds One Known Exploited Vulnerability to Catalog' naming CVE-2026-110447.","source":{"title":"CISA Adds One Known Exploited Vulnerability to Catalog","url":"https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0","publisher":"CISA"},"kind":"kev","addedDate":"2026-10-24"},{"date":"2026-10-23T20:29:26Z","event":"Rachidmarcil posted on X that CISA had added CVE-2026-110447 to KEV and that attackers had planted webshells since September.","source":{"title":"Rachidmarcil on X","url":"https://x.com/Rachidmarcil/status/2113729533832462505","publisher":"Rachidmarcil (X)"},"kind":"other","addedDate":"2026-10-24"},{"date":"2026-10-23T23:12:06Z","event":"ZeroKaiLabs posted on X that the Built-in CODE Server app RCE was exploited and in CISA KEV, and that disabling the app is not enough.","source":{"title":"ZeroKaiLabs on X","url":"https://x.com/ZeroKaiLabs/status/2113770467240878121","publisher":"ZeroKaiLabs (X)"},"kind":"other","addedDate":"2026-10-24"}],"openNotes":[{"title":"Ransomware use is unconfirmed","detail":"A comment on issue 354 (29 Sep 2026) said ransomware operators had started to abuse the flaw. BleepingComputer wrote that some users reported ransomware operators exploiting it, and that BleepingComputer could not independently confirm this. CISA KEV lists knownRansomwareCampaignUse as Unknown.","sources":[{"url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/","date":"2026-10-15","publisher":"BleepingComputer"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-10-23","publisher":"CISA"},{"url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","date":"2026-09-29","publisher":"GitHub / nembo81"}]},{"title":"No verified public PoC as of 24 Oct 2026","detail":"No primary source we opened confirms a public proof-of-concept repository. The aggregator notCVE claimed '2 public exploits' on X on 23 Oct 2026 and listed two GitHub entries. One listing returned 404; the other page did not show a confirmed exploit write-up. Treated as unverified.","sources":[{"url":"https://x.com/notCVE/status/2113730698154533146","date":"2026-10-23T20:34:04Z","publisher":"notCVE (X)"},{"url":"https://notcve.org/cve/CVE-2026-110447","date":"2026-10-23","publisher":"notCVE"}]}],"defenderActions":[{"title":"Find the built-in CODE app","detail":"Inventory Nextcloud instances for the Collabora Online Built-in CODE Server app (richdocumentscode). The optional app is distinct from Nextcloud Office (richdocuments) talking to a separate Collabora server.","priority":"now","links":[{"label":"Collabora advisory","href":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh"}]},{"title":"Upgrade to 26.4.303 or remove the app","detail":"Upgrade richdocumentscode to 26.4.303 or later, or remove the app. Collabora says disabling it is not enough. On Nextcloud 29 and older, upgrade Nextcloud or remove the app; those lines do not get a fixed app build.","priority":"now","links":[{"label":"Collabora advisory","href":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh"}]},{"title":"Hunt access logs back to 10 Sep 2026","detail":"Search web access logs for requests to /apps/richdocumentscode/proxy.php, including paths with command-substitution markers such as $(, URL-encoded %24%28, ${IFS}, base64, or path traversal %2e%2e. The earliest public logs start 10 Sep 2026.","priority":"now","links":[{"label":"GitHub issue 354","href":"https://github.com/CollaboraOnline/richdocumentscode/issues/354"}]},{"title":"Look for unexpected PHP files in the app folder","detail":"Administrators reported planted PHP files matching shx*.php under the app folder. Remove leftover webshells after upgrade. Collabora's mmeeks said to remove lingering shx*.php files.","priority":"now","links":[{"label":"GitHub issue 354","href":"https://github.com/CollaboraOnline/richdocumentscode/issues/354"}]},{"title":"Run Nextcloud integrity checks","detail":"Run occ integrity:check-app (and integrity:check-core if you use it) as a generic way to spot unexpected files. One administrator found a planted PHP file because the integrity check failed.","priority":"now","links":[{"label":"GitHub issue 354","href":"https://github.com/CollaboraOnline/richdocumentscode/issues/354"}]},{"title":"Rotate secrets if you find compromise","detail":"If you find a webshell or a matching request, treat data readable by the web-server account as exposed. Rotate database, object-storage, SMTP, and other secrets that account could read, and review admin users and cron.","priority":"now","links":[{"label":"GitHub issue 354","href":"https://github.com/CollaboraOnline/richdocumentscode/issues/354"}]}],"detection":[{"title":"Requests to proxy.php with command-substitution markers","detail":"Hunt Apache or nginx access logs for /apps/richdocumentscode/proxy.php requests whose path or query contains $(, URL-encoded %24%28, ${IFS}, base64, or %2e%2e. Admins posted this pattern from 10 Sep 2026. Hits are attempts or successful injection, not a complete compromise proof.","logSource":"Web access logs (Apache / nginx)","kind":"generic","group":"web-proxy","url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","date":"2026-09-11"},{"title":"New PHP files under the app folder","detail":"Administrators reported planted files matching shx*.php in apps/richdocumentscode/. Hunt file-create events and integrity failures for unexpected .php files in that directory.","logSource":"File integrity / EDR file-create events","kind":"generic","group":"edr","url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","date":"2026-09-11"},{"title":"Web-server account spawning a shell or downloader","detail":"Hunt for the web-server user (www-data, apache, nginx, http) or the web-server process spawning sh, bash, curl, or wget. Correlate with proxy.php requests. Expect noise from apps that shell out by design.","logSource":"EDR / process telemetry","kind":"generic","group":"edr","url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","date":"2026-09-11"}],"detectionRules":[{"id":"v2s-spl-richdocumentscode-proxy-cmdinject","title":"richdocumentscode proxy.php requests with command-substitution markers","language":"spl","query":"(sourcetype=access_combined OR sourcetype=nginx_access OR sourcetype=nginx:plus:access OR sourcetype=apache:access)\n(\"/apps/richdocumentscode/proxy.php\")\n(\"$(\" OR \"%24%28\" OR \"${IFS}\" OR \"base64\" OR \"%2e%2e\")\n| stats count min(_time) as firstTime max(_time) as lastTime values(clientip) as src by host, uri, status","logSource":"Apache / nginx access logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","sourceDate":"2026-09-11","license":"CC0 1.0","origin":"vuln2shell","notes":"Hunting query from markers admins posted in issue 354. Does not include encoded command strings. Tune sourcetypes to your CIM.","tested":"untested"},{"id":"v2s-logscale-richdocumentscode-proxy-cmdinject","title":"richdocumentscode proxy.php requests with command-substitution markers (Falcon / LogScale)","language":"logscale","query":"/apps\\/richdocumentscode\\/proxy\\.php/\n| regex(\"(?:\\\\$\\\\(|%24%28|\\\\$\\\\{IFS\\\\}|base64|%2e%2e)\")\n| groupBy([#host, uri, statuscode], function=count())","logSource":"CrowdStrike LogScale / Falcon, web access logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","sourceDate":"2026-09-11","license":"CC0 1.0","origin":"vuln2shell","notes":"Same hunt as the SPL rule. Field names vary by parser; adjust uri and statuscode.","tested":"untested"},{"id":"v2s-kql-richdocumentscode-php-created","title":"New PHP files under apps/richdocumentscode (DeviceFileEvents)","language":"kql","query":"DeviceFileEvents\n| where Timestamp > ago(45d)\n| where FolderPath has \"richdocumentscode\"\n| where FileName endswith \".php\"\n| where ActionType has \"FileCreated\"\n| project Timestamp, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessAccountName, SHA256\n| order by Timestamp desc","logSource":"Microsoft Defender for Endpoint DeviceFileEvents","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","sourceDate":"2026-09-11","license":"CC0 1.0","origin":"vuln2shell","notes":"Admins reported planted shx*.php files in the app folder. Baseline first; app updates also write PHP files.","tested":"untested"},{"id":"v2s-kql-web-user-spawns-shell","title":"Web-server user spawning sh, bash, curl, or wget (DeviceProcessEvents)","language":"kql","query":"DeviceProcessEvents\n| where Timestamp > ago(45d)\n| where AccountName in~ (\"www-data\", \"apache\", \"nginx\", \"http\", \"www\")\n    or InitiatingProcessFileName in~ (\"apache2\", \"httpd\", \"nginx\", \"php-fpm\", \"php\")\n| where FileName in~ (\"sh\", \"bash\", \"dash\", \"curl\", \"wget\")\n| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine\n| order by Timestamp desc","logSource":"Microsoft Defender for Endpoint DeviceProcessEvents (Linux servers)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","sourceDate":"2026-09-11","license":"CC0 1.0","origin":"vuln2shell","notes":"Generic post-exploitation hunt. Expect noise from apps that shell out. Correlate with proxy.php requests from 10 Sep 2026.","tested":"untested"},{"id":"v2s-logscale-web-user-spawns-shell","title":"Web-server user spawning sh, bash, curl, or wget (Falcon)","language":"logscale","query":"#event_simpleName=ProcessRollup2 event_platform=Lin\n| UserName=/^(www-data|apache|nginx|http|www)$/i or ParentBaseFileName=/^(apache2|httpd|nginx|php-fpm|php)$/i\n| FileName=/^(sh|bash|dash|curl|wget)$/i\n| groupBy([aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=max)","logSource":"CrowdStrike Falcon ProcessRollup2 (Linux)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","sourceDate":"2026-09-11","license":"CC0 1.0","origin":"vuln2shell","notes":"Same logic as the KQL process rule. Baseline first.","tested":"untested"},{"id":"v2s-sigma-richdocumentscode-proxy-cmdinject","title":"richdocumentscode proxy.php command-substitution markers in web logs","language":"sigma","query":"title: richdocumentscode proxy.php Command Substitution Markers\nid: 7c2e1a90-4b6d-5e18-9f3a-2d8c1b0e6a44\nstatus: experimental\ndescription: Hunts web access logs for requests to the Collabora Built-in CODE Server proxy that include command-substitution or traversal markers reported by administrators for CVE-2026-110447.\nreferences:\n    - https://github.com/CollaboraOnline/richdocumentscode/issues/354\n    - https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh\nauthor: vuln2shell\ndate: 2026-10-24\ntags:\n    - attack.initial-access\n    - attack.t1190\n    - cve.2026-110447\nlogsource:\n    category: webserver\ndetection:\n    endpoint:\n        cs-uri-stem|contains: '/apps/richdocumentscode/proxy.php'\n    markers:\n        cs-uri-query|contains:\n            - '$('\n            - '%24%28'\n            - '${IFS}'\n            - 'base64'\n            - '%2e%2e'\n        cs-uri-stem|contains:\n            - '$('\n            - '%24%28'\n            - '${IFS}'\n            - 'base64'\n            - '%2e%2e'\n    condition: endpoint and markers\nfalsepositives:\n    - Rare legitimate query strings that include the word base64\nlevel: high","logSource":"Web server access logs (Apache / nginx)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","sourceDate":"2026-09-11","license":"CC0 1.0","origin":"vuln2shell","notes":"Field names follow common webserver Sigma mappings. Map cs-uri-stem / cs-uri-query to your pipeline.","tested":"untested"},{"id":"v2s-suricata-richdocumentscode-proxy-cmdinject","title":"HTTP request to richdocumentscode proxy.php with command-substitution markers","language":"suricata","query":"alert http $EXTERNAL_NET any -> $HOME_NET any (msg:\"VULN2SHELL HUNTING Collabora richdocumentscode proxy.php command-substitution markers (CVE-2026-110447)\"; flow:established,to_server; http.uri; content:\"/apps/richdocumentscode/proxy.php\"; nocase; pcre:\"/(\\$\\(|%24%28|\\$\\{IFS\\}|base64|%2e%2e)/i\"; reference:cve,2026-110447; reference:url,github.com/CollaboraOnline/richdocumentscode/issues/354; classtype:web-application-attack; sid:1000002; rev:1;)","logSource":"Suricata HTTP inspection (needs decrypted HTTP)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","sourceDate":"2026-09-11","license":"CC0 1.0","origin":"vuln2shell","notes":"Local sid; renumber to fit your range. Needs TLS termination or decryption to see the URI.","tested":"untested"}],"detectionLinks":[{"title":"Security issue - Hack (#354)","url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","author":"HeikoBw and other administrators","date":"2026-09-11","note":"Access-log samples and webshell filename pattern used for the vuln2shell hunts. Encoded command strings are not copied here."},{"title":"Unauthenticated OS command injection in the richdocumentscode proxy","url":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh","author":"Collabora","date":"2026-10-14"}],"retrohunt":{"summary":"Search Apache or nginx access logs back to 10 Sep 2026 for /apps/richdocumentscode/proxy.php requests with command-substitution markers, then hunt for planted shx*.php files and for the web-server user spawning shells.","lookback":{"from":"2026-09-10","basis":"first-exploitation","rationale":"Administrators posted access logs showing requests at 10 Sep 2026 19:51 (+0200) and 11 Sep 2026 09:56 (+0200) from 139.28.18.122 to /apps/richdocumentscode/proxy.php?status on hosts running 26.4.302. The CVE record says exploitation in September and October 2026.","sources":[{"url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","date":"2026-09-11","publisher":"GitHub issue #354"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110447","date":"2026-10-14","publisher":"CVE"}]},"logSources":[{"name":"Apache / nginx access logs for Nextcloud","why":"Show proxy.php requests and command-substitution markers.","required":true},{"name":"File integrity / EDR file-create events","why":"Administrators found planted shx*.php under the app folder.","required":true},{"name":"EDR process telemetry for the web-server user","why":"Shows www-data / apache / nginx spawning sh, bash, curl or wget.","required":true},{"name":"Nextcloud integrity check output","why":"One administrator found a planted PHP file because the integrity check failed.","required":false}],"steps":[{"title":"Search access logs for proxy.php with injection markers","detail":"Hunt /apps/richdocumentscode/proxy.php requests whose path or query contains $(, URL-encoded %24%28, ${IFS}, base64 or %2e%2e.","sources":[{"url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","date":"2026-09-11","publisher":"GitHub issue #354"}]},{"title":"Search for planted PHP files","detail":"Administrators reported files matching shx*.php under apps/richdocumentscode/. Collabora's mmeeks said to remove lingering shx*.php files.","sources":[{"url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","date":"2026-09-11","publisher":"GitHub issue #354"}]},{"title":"Hunt web-server shells","detail":"Look for the web-server account or process spawning sh, bash, curl or wget, and correlate with proxy.php requests.","sources":[{"url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","date":"2026-09-11","publisher":"GitHub issue #354"}]},{"title":"Run Nextcloud integrity checks","detail":"Run occ integrity:check-app (and integrity:check-core if you use it) to spot unexpected files.","sources":[{"url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","date":"2026-09-11","publisher":"GitHub issue #354"}]}],"queries":[{"id":"v2s-rh-spl-richdocumentscode","title":"richdocumentscode proxy.php injection markers since 10 Sep 2026","language":"spl","query":"(sourcetype=access_combined OR sourcetype=nginx_access OR sourcetype=nginx:plus:access OR sourcetype=apache:access) earliest=\"09/10/2026:00:00:00\"\n(\"/apps/richdocumentscode/proxy.php\") (\"$(\" OR \"%24%28\" OR \"${IFS}\" OR \"base64\" OR \"%2e%2e\")\n| stats count min(_time) as firstTime max(_time) as lastTime values(clientip) as src by host, uri, status\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Apache / nginx access logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","sourceDate":"2026-09-11","license":"CC0 1.0","origin":"vuln2shell","notes":"Hits are attempts or successful injection, not a complete compromise proof.","tested":"untested","timeRange":"From 2026-09-10"},{"id":"v2s-rh-kql-richdocumentscode-php","title":"New PHP files under richdocumentscode since 10 Sep 2026","language":"kql","query":"DeviceFileEvents\n| where Timestamp >= datetime(2026-09-10)\n| where FolderPath has \"richdocumentscode\"\n| where FileName endswith \".php\"\n| where ActionType has \"FileCreated\"\n| project Timestamp, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessAccountName, SHA256\n| order by Timestamp desc","logSource":"Microsoft Defender for Endpoint DeviceFileEvents","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","sourceDate":"2026-09-11","license":"CC0 1.0","origin":"vuln2shell","tested":"untested","timeRange":"From 2026-09-10, limited by retention"},{"id":"v2s-rh-logscale-richdocumentscode","title":"richdocumentscode proxy.php injection markers","language":"logscale","query":"// Set the time picker to start 2026-09-10\n/apps\\/richdocumentscode\\/proxy\\.php/\n| regex(\"(?:\\$\\(|%24%28|\\$\\{IFS\\}|base64|%2e%2e)\")\n| groupBy([#host, uri, statuscode], function=[count(), min(@timestamp, as=firstSeen)])","logSource":"Web access logs in LogScale","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","sourceDate":"2026-09-11","license":"CC0 1.0","origin":"vuln2shell","tested":"untested","timeRange":"From 2026-09-10"}],"thirdPartyQueries":[],"artefacts":[{"kind":"web-log","value":"/apps/richdocumentscode/proxy.php with $(, %24%28, ${IFS}, base64 or %2e%2e","detail":"Command-injection request.","sourceUrl":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","sourceDate":"2026-09-11"},{"kind":"file","value":"shx*.php under apps/richdocumentscode/","detail":"Planted webshell.","sourceUrl":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","sourceDate":"2026-09-11"},{"kind":"process","value":"www-data / apache / nginx spawning sh, bash, curl or wget","detail":"Post-exploitation.","sourceUrl":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","sourceDate":"2026-09-11"}],"iocs":[{"type":"ip","value":"139.28.18[.]122","context":"Source of the 10 and 11 Sep 2026 requests posted in issue #354.","sourceUrl":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","sourceDate":"2026-09-11"},{"type":"ip","value":"89.38.98[.]50","context":"Source of a 14 Sep 2026 follow-up request against a host already on 26.4.303.","sourceUrl":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","sourceDate":"2026-09-14"},{"type":"filename","value":"shx*.php","context":"Planted PHP file pattern reported by administrators.","sourceUrl":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","sourceDate":"2026-09-11"}],"hitMeaning":[{"level":"attempt","detail":"proxy.php request with injection markers and no planted file."},{"level":"likely-compromise","detail":"A planted shx*.php file, or the web-server user spawning a shell after such a request."},{"level":"confirmed-compromise","detail":"A webshell that ran, or outbound callbacks from the web-server account."}],"nextSteps":[{"title":"Upgrade or remove the app","detail":"Upgrade richdocumentscode to 26.4.303 or later, or remove it. Collabora says disabling it is not enough.","links":[{"label":"GHSA-g3vx-3m76-fghh","href":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh"}]},{"title":"Remove webshells and rotate secrets","detail":"Delete lingering shx*.php files and rotate secrets the web-server account could read.","links":[{"label":"Issue #354","href":"https://github.com/CollaboraOnline/richdocumentscode/issues/354"}]}],"limits":["Access logs may not retain query strings.","Apps that shell out by design create noise in the process hunt."],"sources":[{"url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","date":"2026-09-11","publisher":"GitHub issue #354"},{"url":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh","date":"2026-10-14","publisher":"Collabora"}],"updatedAt":"2026-10-24"},"amIAffected":{"summary":"Only the optional Nextcloud app Collabora Online Built-in CODE Server (richdocumentscode) before 26.4.303. Collabora GHSA 14 Oct 2026: patched 26.4.303. Disabling the app is not enough; upgrade or remove it. Attack works while the built-in CODE server is not running (restart, upgrade, crash). Users of EOL Nextcloud <= 29 should upgrade Nextcloud or remove the app. Standalone Collabora Online servers are not affected (vendor statement). Nextcloud Office (richdocuments) talking to a separate Collabora server is a different component.","checks":[{"id":"v2s-aia-nextcloud-collabora-code-package-1","kind":"package","title":"richdocumentscode installed and its version","detail":"Collabora: affected < 26.4.303, patched 26.4.303. Inventory the app even if it is disabled. occ app:list is the Nextcloud CLI the catalog already points at.","command":"sudo -u www-data php occ app:list; sudo -u www-data php occ app:list | grep -i richdocuments","affectedMeans":"richdocumentscode is present at a version before 26.4.303, enabled or disabled. Nextcloud 29 and older cannot get a fixed app build (Collabora: upgrade Nextcloud or remove the app). Catalog note 24 Oct 2026: Nextcloud 25-29 app store listed 26.4.104, which is before 26.4.303.","fixedMeans":"richdocumentscode 26.4.303 or later, or the app is removed (not merely disabled). occ app:list no longer lists richdocumentscode, or lists 26.4.303+.","notes":"Run occ as the web-server user for your install (www-data, apache, nginx, http). Path to occ is the Nextcloud root. richdocuments (Nextcloud Office) is not this CVE.","sources":[{"url":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh","date":"2026-10-14","publisher":"Collabora"}]},{"id":"v2s-aia-nextcloud-collabora-code-config-2","kind":"config","title":"App directory still on disk after a UI disable","detail":"Collabora: it is not sufficient to disable the app. Confirm the files are gone or the version file says 26.4.303+.","command":"ls -la apps/richdocumentscode apps/richdocumentscode/appinfo/info.xml 2>/dev/null; grep -E '<id>|<version>' apps/richdocumentscode/appinfo/info.xml 2>/dev/null","affectedMeans":"apps/richdocumentscode exists and info.xml version is before 26.4.303, including a disabled app.","fixedMeans":"Directory removed, or info.xml version is 26.4.303 or later.","sources":[{"url":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh","date":"2026-10-14","publisher":"Collabora"}]},{"id":"v2s-aia-nextcloud-collabora-code-config-3","kind":"config","title":"Do not treat Nextcloud Office + standalone Collabora as this CVE","detail":"Collabora vendor statement 14 Oct 2026: standalone Collabora Online servers are not affected. The optional built-in CODE app that launches a local AppImage is the in-scope component (mmeeks on issue 354, 14 Sep 2026: Development Edition in Built-in CODE Server mode).","command":"sudo -u www-data php occ app:list | grep -iE 'richdocuments|collabora'","affectedMeans":"richdocumentscode (built-in CODE) is installed below 26.4.303.","fixedMeans":"No richdocumentscode, or 26.4.303+. A richdocuments-only install talking to a standalone Collabora server matches the vendor not-affected statement for standalone Collabora Online. That statement does not cover the built-in app.","sources":[{"url":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh","date":"2026-10-14","publisher":"Collabora"},{"url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","date":"2026-09-14","publisher":"GitHub / mmeeks"}]}],"limits":["No sourced Shodan or Censys string for this app. Do not invent one.","BleepingComputer 15 Oct 2026 attributed not-affected status for Docker, RPM/DEB, and Nextcloud All-in-One to Collabora. GHSA only says standalone Collabora Online servers are not affected. Do not repeat the AIO/Docker/RPM sentence as a vendor statement.","CODE-server-down is an exploit precondition, not an inventory safe state. A running CODE process can still crash or restart.","occ app:list as root may fail; use the web-server account."],"sources":[{"url":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh","date":"2026-10-14","publisher":"Collabora"},{"url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","date":"2026-09-14","publisher":"GitHub / mmeeks"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"mitigations":{"summary":"Collabora says disabling the app is not enough. Upgrade richdocumentscode to 26.4.303 or remove the app. Nextcloud 29 and older do not get a fixed app build.","items":[{"title":"Remove the richdocumentscode app (vendor alternative to upgrade)","detail":"Collabora GHSA 14 Oct 2026: it is not sufficient to disable the app; it must be upgraded to >= 26.4.303 or removed. EOL Nextcloud <=29: upgrade Nextcloud or remove this app. This is elimination of the component, not a stay-vulnerable workaround.","limits":"Built-in CODE editing goes away until you point Nextcloud Office at a standalone Collabora server (that standalone server is vendor-stated not affected). Disable in the UI is not this mitigation. After remove, hunt leftover shx*.php (mmeeks 18 Sep 2026).","verify":"occ app:list does not list richdocumentscode. ls apps/richdocumentscode fails. Integrity check no longer flags that app path. Then search for lingering shx*.php under the old path.","source":{"url":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh","date":"2026-10-14","publisher":"Collabora"}}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"response":{"summary":"Block /apps/richdocumentscode/proxy.php if you see injection, then hunt planted PHP files matching shx*.php under the app folder. Administrators reported those files from 10 Sep 2026.","containment":[{"title":"Block /apps/richdocumentscode/proxy.php and take the host off the internet if you see injection or a webshell","detail":"Issue 354 (10-11 Sep 2026 logs): unauthenticated GET to /apps/richdocumentscode/proxy.php?status with $( ), ${IFS}, base64, and %2e%2e. Contain at the reverse proxy before you clean disks.","sources":[{"url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","date":"2026-09-11","publisher":"GitHub / HeikoBw"}]},{"title":"Upgrade to 26.4.303 or remove the app, then delete leftover shx*.php","detail":"mmeeks 18 Sep 2026: upgrade to 26.4.303 and remove lingering shx*.php. GHSA: disable is not enough. A 14 Sep 2026 request against a host already on 26.4.303 still returned 200 (UlliDieckmann); treat leftover files and processes separately from the version bump.","sources":[{"url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","date":"2026-09-18","publisher":"GitHub / mmeeks"},{"url":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh","date":"2026-10-14","publisher":"Collabora"}]}],"rotate":[{"item":"Nextcloud secrets the web-server user can read (config.php database password, instance secret, object-store keys, SMTP)","reason":"GHSA: command runs as the web server user. Catalog defender action 24 Oct 2026 restates rotate database, object-storage, SMTP if you find a webshell. No vendor list of exact key names beyond that class of secrets.","generic":true,"sources":[{"url":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh","date":"2026-10-14","publisher":"Collabora"},{"url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","date":"2026-09-11","publisher":"GitHub / HeikoBw"}]},{"item":"Admin sessions, app passwords, and any password-manager or wallet material stored on the instance","reason":"BleepingComputer 15 Oct 2026: admins reported webshells used to search for password databases, password-manager artefacts, and cryptocurrency wallets. Issue 354 recovered payload text listed *.kdbx, wallet.dat, keystore.json, bitwarden, 1password, .bitcoin, .electrum, .monero, .ethereum. Rotate those if present. Ransomware use remains unconfirmed (BleepingComputer could not confirm; CISA KEV knownRansomwareCampaignUse Unknown).","sources":[{"url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/","date":"2026-10-15","publisher":"BleepingComputer"},{"url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","date":"2026-09-11","publisher":"GitHub / HeikoBw"}]}],"persistence":[{"kind":"webshell","value":"shx*.php under apps/richdocumentscode/","detail":"Issue 354: observed webshell filenames followed /apps/richdocumentscode/shx*.php. mmeeks 18 Sep 2026 told operators to remove lingering shx*.php.","sourceUrl":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","sourceDate":"2026-09-11"},{"kind":"webshell","value":"shrf4645.php and shxa35d0.php","detail":"HeikoBw 11 Sep 2026: attacker created those PHP webshells after the 10 Sep 19:51 +0200 and 11 Sep 09:56 +0200 requests from 139.28.18.122 against hosts on 26.4.302.","sourceUrl":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","sourceDate":"2026-09-11"}],"evidence":[{"title":"Apache/nginx access logs for proxy.php from 10 Sep 2026","detail":"Preserve requests to /apps/richdocumentscode/proxy.php?status with $(, %24%28, ${IFS}, base64, %2e%2e. Earliest public logs: 10 Sep 2026 19:51 +0200 and 11 Sep 2026 09:56 +0200 from 139.28.18.122. Follow-up 14 Sep 2026 19:04 +0200 from 89.38.98.50 after a 26.4.303 upgrade.","sources":[{"url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","date":"2026-09-11","publisher":"GitHub / HeikoBw"}]},{"title":"Nextcloud integrity check output","detail":"Catalog and issue 354: one administrator found a planted PHP file because the integrity check failed. Run occ integrity:check-app (and integrity:check-core if you use it) and keep the output.","sources":[{"url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","date":"2026-09-11","publisher":"GitHub / HeikoBw"}]},{"title":"Outbound callbacks to webhook.site and www-data process list","detail":"Issue 354 payloads curl/wget to webhook.site after writing the PHP file. UlliDieckmann 14 Sep 2026 posted www-data processes launching Collabora_Online.AppImage / AppRun / coolwsd with a remote_font_config.url that still contained the injection; mmeeks said that ps output looks scary but should be harmless (invalid font server) if the first launch was poisoned. ahlund 18 Sep 2026: mail about failed sudo attempts from the server.","sources":[{"url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","date":"2026-09-11","publisher":"GitHub / HeikoBw"}]},{"title":"File listing of apps/richdocumentscode and web-server homedir before rebuild","detail":"Copy the app folder and any unexpected .php before delete. Compare to 10 Sep 2026. Also keep /tmp/coolwsd* and AppImage extract dirs named in the 14 Sep ps output if you still have them.","generic":true,"sources":[{"url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","date":"2026-09-14","publisher":"GitHub / UlliDieckmann"}]}],"sources":[{"url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","date":"2026-09-11","publisher":"GitHub / HeikoBw"},{"url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","date":"2026-09-18","publisher":"GitHub / mmeeks"},{"url":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh","date":"2026-10-14","publisher":"Collabora"},{"url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/","date":"2026-10-15","publisher":"BleepingComputer"},{"url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","date":"2026-09-14","publisher":"GitHub / UlliDieckmann"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"bulletins":[{"vendor":"Collabora","title":"Unauthenticated OS command injection in the richdocumentscode proxy (GHSA-g3vx-3m76-fghh)","url":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh","date":"2026-10-14","cve":"CVE-2026-110447"},{"vendor":"CISA","title":"CISA Adds One Known Exploited Vulnerability to Catalog","url":"https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0","date":"2026-10-23","cve":"CVE-2026-110447"}],"coverage":[{"title":"Unauthenticated OS command injection in the richdocumentscode proxy","publisher":"Collabora","url":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh","date":"2026-10-14","type":"vendor","addedDate":"2026-10-24"},{"title":"CVE Record: CVE-2026-110447","publisher":"CVE Program","url":"https://www.cve.org/CVERecord?id=CVE-2026-110447","date":"2026-10-14","type":"vendor","addedDate":"2026-10-24"},{"title":"CISA Adds One Known Exploited Vulnerability to Catalog","publisher":"CISA","url":"https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0","date":"2026-10-23","type":"government","addedDate":"2026-10-24"},{"title":"To Collabora Built-in User: Update ASAP","publisher":"Nextcloud community forum","url":"https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516","date":"2026-10-03","type":"vendor","addedDate":"2026-10-24"},{"title":"Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers","publisher":"BleepingComputer (Bill Toulas)","url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/","date":"2026-10-15","type":"news","addedDate":"2026-10-24"},{"title":"Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora's Built-in CODE App","publisher":"The Hacker News (Swati Khandelwal)","url":"https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html","date":"2026-10-14","type":"news","addedDate":"2026-10-24"}],"posts":[{"author_name":"Ai news","handle":"Rachidmarcil","url":"https://x.com/Rachidmarcil/status/2113729533832462505","date":"2026-10-23T20:29:26Z","text":"🚨 CISA added CVE-2026-110447 to its KEV catalog: unauthenticated OS command injection (CVSS 9.2) in Nextcloud's Collabora Built-in CODE Server app. Attackers planted webshells since September — update richdocumentscode to 26.4.303 or remove it. https://t.co/AvBOX2L33M"},{"author_name":"ZeroKai","handle":"ZeroKaiLabs","url":"https://x.com/ZeroKaiLabs/status/2113770467240878121","date":"2026-10-23T23:12:06Z","text":"NextcloudのCollabora CODE Serverアプリに悪用中のRCE脆弱性CVE-2026-110447。26.4.303以上へ更新か削除を(無効化は不十分)。\nNextcloud Collabora Built-in CODE Server app RCE CVE-2026-110447 (exploited, CISA KEV): update to 26.4.303+ or remove it.\nhttps://t.co/RlJYY5P55a"}],"research":[{"title":"Unauthenticated OS command injection in the richdocumentscode proxy","url":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh","authors":"Collabora (published by caolanm)","date":"14 Oct 2026"},{"title":"CVE Record: CVE-2026-110447","url":"https://www.cve.org/CVERecord?id=CVE-2026-110447","authors":"CVE Program","date":"Updated 2026-10-14"},{"title":"Security issue - Hack (#354)","url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","authors":"HeikoBw and other administrators","date":"Opened 2026-09-11T14:53:46Z"},{"title":"CISA KEV catalog JSON (CVE-2026-110447 listed; catalog 2026.10.23)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","authors":"CISA","date":"catalog 2026.10.23, checked 24 Oct 2026"},{"title":"CISA Adds One Known Exploited Vulnerability to Catalog","url":"https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0","authors":"CISA","date":"23 Oct 2026"}],"impact":{"kind":"shared-component","component":"Collabora Online Built-in CODE Server (richdocumentscode)","matrixNote":"Only the optional Nextcloud app that launches a local CODE AppImage is in scope. Standalone Collabora Online is not affected per Collabora. Nextcloud 29 and older cannot install the fixed app build.","downstream":[{"product":"Collabora Online Built-in CODE Server (richdocumentscode)","vendor":"Collabora","type":"cms-app","notes":"Affected before 26.4.303. Disabling the app is not enough; upgrade or remove it.","status":"affected","versions":"26.4.303","vendorStatement":{"date":"14 Oct 2026","url":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh","quote":"Affected versions: < 26.4.303. Patched versions: 26.4.303. It is not sufficient to disable the app to avoid the problem, it must be upgraded to >= 26.4.303 or removed."},"addedDate":"2026-10-24"},{"product":"Collabora Online standalone","vendor":"Collabora","type":"cms-app","status":"vendor-stated-not-affected","vendorStatement":{"date":"14 Oct 2026","url":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh","quote":"Standalone Collabora Online servers are not affected."},"addedDate":"2026-10-24"},{"product":"Nextcloud server 29 and older","vendor":"Nextcloud","type":"cms-app","notes":"App store listing checked 24 Oct 2026: Nextcloud 30 and later list richdocumentscode 26.4.502; Nextcloud 25 to 29 list 26.4.104, which is before 26.4.303.","status":"affected","versions":"No fixed richdocumentscode build; upgrade Nextcloud or remove the app","vendorStatement":{"date":"14 Oct 2026","url":"https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh","quote":"Users of EOL Nextcloud <= 29 should upgrade their Nextcloud or remove this app."},"addedDate":"2026-10-24"}]},"pocs":[],"pocEmptyState":"No public PoC is confirmed by a primary source as of 24 Oct 2026. The aggregator notCVE claimed '2 public exploits' on X on 23 Oct 2026. We opened that listing; one linked repository returned 404 and the other page did not confirm exploit code. Encoded attack strings from issue 354 are not reproduced here.","_feed":{"page":"https://vuln2shell.com/vulns/nextcloud-collabora-code","json":"https://vuln2shell.com/vulns/nextcloud-collabora-code.json","iocsCsv":"https://vuln2shell.com/vulns/nextcloud-collabora-code/iocs.csv","stix":"https://vuln2shell.com/vulns/nextcloud-collabora-code/stix.json"}}