Collabora CODE CVSS 9.2 command injection added to CISA KEV

Collabora Online built-in CODE server command injection added to CISA KEV with emergency three-day order

The United States Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-110447, a critical operating system command injection vulnerability in the Collabora Online Built-in CODE Server application for Nextcloud, to its Known Exploited Vulnerabilities catalog. Tracked with a CVSS v3.1 base score of 9.2, the vulnerability allows unauthenticated remote attackers to execute arbitrary system commands under the security context of the web server daemon. Due to widespread and aggressive exploitation in the wild, CISA issued an urgent Binding Operational Directive compliance deadline of 26 October 2026, granting federal agencies just three days to remediate vulnerable deployments.

The vulnerability resides in proxy.php, a script shipped within the optional richdocumentscode application package designed to simplify office document editing for self-hosted Nextcloud environments. Exactly 42 days (derived) elapsed between the public release of the vendor patch in richdocumentscode version 26.4.303 on 11 September 2026 and CISA's catalog inclusion on 23 October 2026. Threat actors have capitalised on this substantial patch lag to compromise private cloud instances, deploy persistent PHP webshells, and harvest high-value credentials, focusing specifically on KeePass password databases, browser password manager storage, and cryptocurrency wallet keys.

Technical execution flow and unauthenticated command injection chain

Zoom

Computed operational metrics and incident telemetry

A quantitative evaluation of the incident timeline reveals the severity of the operational window exploited by threat actors across internet-facing Nextcloud deployments:

Computed operational metrics and disclosure timeline for CVE-2026-110447

Metric	Observed Value	Operational Significance
Vendor Patch Availability	11 September 2026	richdocumentscode 26.4.303 released silently resolving command injection in proxy.php.
CISA KEV Catalog Addition	23 October 2026	Confirmed active in-the-wild exploitation targeting enterprise and private cloud storage.
Exposure Interval to KEV Listing	42 days (derived)	Length of time unpatched internet-facing Nextcloud servers remained exposed following vendor fix.
Federal Remediation Deadline	26 October 2026	Mandatory remediation deadline mandated under CISA Binding Operational Directive 22-01.
Remediation Window Allowed	3 days (derived)	An 85.7% compression (derived) from CISA standard 21-day timeline, signalling acute threat severity.
CVSS v3.1 Severity Rating	9.2 (Critical)	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N reflecting unauthenticated remote execution without user interaction.
Affected Architectural Scope	richdocumentscode only	Zero impact on standalone Collabora Online servers or standard containerised deployments.

Epistemic audit of confirmed disclosures versus unstated operational factors

To maintain strict defensive clarity, the following analytical matrix contrasts what has been definitively confirmed by vendor advisories, CISA records, and incident response reports against factors that remain unverified or unstated in the public domain.

Epistemic matrix comparing confirmed technical disclosures against unstated operational factors

Analytical Dimension	Stated in Primary Records	Unstated or Operationally Unresolved
Vulnerability Mechanism	Command injection in proxy.php via CWE-78 when the local document server daemon is offline or restarting.	The complete source code diff of the proprietary pre-compiled daemon wrapper binaries.
Exploit Conditions	Unauthenticated HTTP requests with directory traversal sequences reaching status handling routines.	Exact number of unique public Nextcloud instances currently compromised globally.
Attacker Payloads	Deployment of PHP webshells conforming to shx naming conventions in the application directory tree.	Whether threat actors possess automated secondary persistence mechanisms outside the web root.
Targeted Data Assets	Active automated searching for KeePass .kdbx files, browser credential stores, and crypto wallets.	The specific threat group or nation-state attribution behind the coordinated exploitation campaign.
App Management Impact	Disabling richdocumentscode inside the web administration panel fails to neutralise the vulnerability.	Whether Nextcloud will deprecate built-in daemon bundles in favour of isolated container architectures.

The friendly-name fallacy: How architectural abstractions created a critical blind spot

Enterprise software architectures frequently rely on comforting abstractions that mask significant operational risk. In the Nextcloud ecosystem, the Collabora Online Built-in CODE Server was branded as a convenient, zero-configuration solution for small and medium-sized organisations that wished to avoid the complexity of deploying a standalone document server. This marketing framing represents a classic friendly-name fallacy. Labelled as a built-in server, administrators assumed that it operated as an integrated, memory-safe component of the Nextcloud PHP application, governed by the standard authentication gates and permission models of the core content management platform.

In reality, the built-in app is a heavyweight hybrid shim. It packages pre-compiled x86_64 and ARM64 Linux binaries containing LibreOffice core rendering libraries, systemd process management hooks, and a complex PHP proxy script designed to bridge web requests to a background UNIX socket or loopback TCP port. By bundling a standalone daemon inside a web-accessible application directory, the architecture created a direct bypass of Nextcloud's core routing engine. The script proxy.php was intentionally exposed to handle document rendering status checks before user sessions were authenticated. When convenience replaced network isolation, a single flaw in that wrapper script exposed the entire host operating system to unauthenticated command injection.

Technical forensic autopsy across five attack phases

Phase 1: Architecture of the Built-in CODE Wrapper and proxy.php

The standard enterprise deployment of Collabora Online, known as Collabora Online Development Edition (CODE), runs as an isolated microservice, typically packaged inside a hardened Docker container or on a dedicated Linux host. In that conventional architecture, communication between Nextcloud and the document server is brokered by the richdocuments app via secure HTTP REST APIs, enforcing authentication tokens and strict network segmentation. However, the richdocumentscode app bypasses this isolation entirely by shipping the CODE server binaries directly inside Nextcloud's apps/richdocumentscode directory.

To manage this local daemon without requiring root privileges, the package relies on proxy.php as an unauthenticated gateway. When a client requests a document or checks server readiness, proxy.php acts as a reverse proxy. It inspects whether the local daemon is active by querying an internal status endpoint or checking process identifiers in the system runtime path. Because this status query must execute before an office session can initialise, Nextcloud's standard session authentication middleware is explicitly bypassed for the proxy endpoint, making it directly accessible to any unauthenticated remote client on the public internet.

Phase 2: The Race Window and Command Injection Mechanism (CWE-78)

The critical vulnerability within proxy.php occurs during daemon state transitions. Under normal conditions, when the local CODE daemon is running steadily, incoming requests are forwarded via standard socket connections. However, if the daemon process is offline, restarting, or recovering from a crash, proxy.php enters an error-handling and startup launcher routine.

In this state, the script evaluates incoming request parameters to determine the appropriate daemon launch parameters and environment paths. The application failed to adequately sanitise path parameters, permitting URL-encoded directory traversal sequences such as %2e%2e. Furthermore, the wrapper script constructed a command string passed to an internal system execution function without escaping shell metacharacters or using parameterised arrays. By appending command substitution syntax or subshell execution operators within the crafted status parameter, an attacker forces the web server's underlying shell (typically /bin/sh or /bin/bash) to evaluate arbitrary commands under the permissions of the web server user, commonly www-data or nginx.

Phase 3: Post-Exploitation Webshell Deployment

Following successful remote command execution, threat actors observed in the wild immediately transition from transient command injection to durable web persistence. Because the web server process retains write permissions across substantial portions of the Nextcloud installation directory, attackers write lightweight PHP webshells directly into the web root.

Telemetry documented across forensic investigations reveals that threat actors consistently deploy webshells following specific naming conventions, notably shx followed by random alphanumeric strings and a .php extension, placed inside the apps/richdocumentscode directory or adjacent application paths. These webshells provide interactive command execution capabilities, file upload and download utilities, and database query interfaces. By embedding the backdoor inside an official application path, attackers successfully blend into administrative traffic, evading basic file integrity monitors that only inspect core Nextcloud files while ignoring third-party application directories.

Phase 4: Systematic Credential Vault Scraping

Unlike generalised botnet infections that deploy cryptocurrency miners or distributed denial of service bots, threat actors targeting CVE-2026-110447 engage in structured data exfiltration focused on identity and financial assets. Because Nextcloud frequently serves as a private, self-hosted alternative to public commercial cloud storage, organisations and high-net-worth individuals routinely store sensitive administrative vaults on these platforms.

Forensic analysis of compromised systems indicates that automated post-exploitation scripts execute comprehensive filesystem sweeps immediately upon webshell deployment. Attackers execute find and grep commands across the Nextcloud data directory searching for:

1. KeePass database containers, identified by the .kdbx file extension.
2. Browser and desktop password manager caches, targeting local SQLite databases and encrypted JSON storage belonging to Bitwarden, 1Password, and Proton Pass.
3. Cryptocurrency wallet storage, specifically hunting for wallet.dat files, keystore JSON blobs, and private key exports.
4. Core Nextcloud database configuration, parsing config/config.php to extract plaintext database usernames, passwords, instance salts, and administrative email addresses.
5. SSH private keys stored in user home folders and hidden directories across the server.

Phase 5: The Disabled App Persistence Trap

A critical failure observed across impacted organisations involves misunderstood application lifecycle management. When news of the vulnerability initially surfaced, numerous system administrators attempted to mitigate the risk by navigating to the Nextcloud web management console and selecting the Disable option on the Collabora Online Built-in CODE Server app.

This action provides a completely false sense of security. Disabling an application in Nextcloud merely sets an internal database flag in the oc_appconfig table instructing the core framework not to route standard application navigation menus or register background cron jobs. It does not delete the files from disk. Because the web server web root directly maps the filesystem path, an external HTTP request directed to /apps/richdocumentscode/proxy.php continues to execute the PHP file directly. Even worse, if an attacker had already exploited the server prior to the administrator disabling the app, the planted webshells remain fully accessible and functional. The only effective remediations are upgrading to version 26.4.303 or executing a full administrative removal.

UK regulatory compliance, Cyber Essentials, and NCSC guidance alignment

For organisations operating within the United Kingdom, the exploitation of CVE-2026-110447 triggers significant regulatory and standards obligations across multiple government frameworks.

The National Cyber Security Centre (NCSC) addresses this architectural vulnerability through its published Cloud Security Principles. Principle 2 mandates robust asset protection, stating that data held within cloud environments must be protected from unauthorised access, modification, and exfiltration. The NCSC guidance on self-hosted cloud services explicitly warns that deploying applications with embedded binary daemons increases the attack surface beyond standard web applications. Furthermore, NCSC Vulnerability Management Guidance stresses that security teams must prioritise remediation based on active exploitation telemetry rather than static CVSS scores alone. When an unauthenticated vulnerability with active webshell deployment appears in authoritative threat catalogs, standard monthly maintenance windows must be abandoned in favour of emergency out-of-band patching.

Under the UK Cyber Essentials scheme (Specification v3.3), certified organisations are legally bound to apply security updates for all internet-facing software within 14 days of release if the vulnerability is rated as critical or has an associated CVSS v3 score of 7.0 or higher. With richdocumentscode 26.4.303 released on 11 September 2026 and carrying a CVSS score of 9.2, any UK organisation holding Cyber Essentials or Cyber Essentials Plus certification that had not applied the update by 25 September 2026 was in direct non-compliance with certification requirements. The 42-day delay (derived) leading up to CISA's KEV listing represents a severe compliance failure.

From a data privacy perspective, the targeting of password vaults and database secrets engages the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Under Article 32, data controllers must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. If an unpatched Nextcloud server leads to the exfiltration of an employee or customer password vault, the organisation faces a mandatory 72-hour notification requirement to the Information Commissioner's Office (ICO). Crucially, the ICO does not view self-hosting as a defence against negligence; failing to patch a known, actively exploited critical vulnerability on an internet-facing credential store represents a failure of basic technical due diligence.

Prioritised defensive checklist for Nextcloud and Collabora administrators

Administrators managing Nextcloud installations must immediately execute the following five-stage verification and remediation protocol:

1. Verify Installed Package Version: Inspect the current version of the built-in server app using the Nextcloud command-line utility by running occ app:list. If richdocumentscode is present and below version 26.4.303, the host must be treated as potentially compromised.

2. Execute Immediate Remediation: Update the package immediately using occ app:update richdocumentscode. If the built-in document server is not strictly required, remove it entirely from disk using occ app:remove richdocumentscode. Do not rely on web-based disabling.

3. Conduct Web Root Threat Hunting: Perform an immediate filesystem scan across the Nextcloud apps directory for unauthorized PHP scripts. Search specifically for files matching patterns such as shx*.php or any newly created PHP files modified since 1 September 2026.

4. Inspect Web Server Access Logs: Audit historical HTTP server access logs for anomalous requests to proxy.php. Search specifically for request strings containing directory traversal patterns (%2e%2e or ..), parameter strings referencing shell commands, or abnormal status checks originating from untrusted public IP addresses.

5. Rotate Critical Credentials: If evidence of compromise or suspicious access is identified, immediately rotate all database credentials defined in config/config.php, invalidate all active Nextcloud user sessions, and notify users who store KeePass or password manager backups to change master passwords and rotate all contained secrets.

The exposing question for enterprise infrastructure leadership

If your organisation deployed self-hosted cloud storage to ensure sovereign control over corporate documents and credentials, why did your vulnerability management processes treat an integrated binary document daemon as an unmonitored web plugin, leaving your most sensitive password vaults exposed to unauthenticated command injection for 42 days?

Key operational facts

Essential technical and compliance parameters for CVE-2026-110447

Parameter	Verified Technical Detail
Vulnerability Identifier	CVE-2026-110447
Common Weakness Enumeration	CWE-78: Improper Neutralization of Special Elements used in an OS Command
CVSS v3.1 Severity Score	9.2 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Affected Software Component	Collabora Online Built-in CODE Server (richdocumentscode) prior to 26.4.303
Unaffected Deployments	Standalone Collabora Online servers, containerised CODE instances, core Nextcloud Office
CISA KEV Addition Date	23 October 2026
CISA Federal Due Date	26 October 2026 (Emergency 3-day compliance window)
Vendor Patch Availability Date	11 September 2026 (richdocumentscode 26.4.303)
Observed In-the-Wild Payloads	PHP webshell deployment (shx*.php), automated credential vault and crypto wallet scraping
Mandatory Remediation Action	Upgrade package to 26.4.303+ or full removal via occ app:remove richdocumentscode