Attackers are exploiting a critical command injection flaw in a Nextcloud app to plant PHP webshells on self-hosted servers, according to SecurityOnline reporting. The vulnerability, CVE-2026-110447, carries a CVSS score of 9.2 and requires no authentication. The details below come from that single report, and no second source corroborates them.
CVE-2026-110447 Affects the Built-In Collabora CODE Server App
The flaw is an OS command injection in the Nextcloud “Collabora Online – Built-in CODE Server” app, known as richdocumentscode, in versions before 26.4.303. It is distinct from an older flaw, CVE-2025-66208. Unauthenticated attackers can use it to plant PHP webshells.
How the proxy.php Injection Works
The bug sits in proxy.php and appears when the CODE server is not running, for example after a restart. In that state, unescaped URL path values are passed into the remote_font_config.url argument when the app launches Collabora_Online.AppImage. That allows shell substitution using $() and ${IFS} obfuscation.
The attacker’s payload is Base64-decoded and drops webshells with names resembling /apps/richdocumentscode/shx.php or shrf.php. The payload also beacons to webhook.site URLs.
Operators Reported Unauthorized Webshells
Multiple Nextcloud operators reported unauthorized webshells in a community alert and in a GitHub issue, number 354. SecurityOnline places the exploitation between September and October 2026.
The GitHub issue and the community alert are the primary evidence in the report. The file-name patterns SecurityOnline lists, shx.php and shrf.php, appear in the paths under /apps/richdocumentscode/ that the payload writes.
Attackers Searched for Password Vaults and Crypto Wallets
After gaining access as the web server account, the attackers searched the file system for *.kdbx files, wallet.dat, keystore.json and directories associated with Bitwarden, 1Password, Bitcoin, Monero and Ethereum. The pattern points to credential and cryptocurrency theft as the goal, rather than defacement or ransomware.
Patching Does Not Remove an Existing Backdoor
Nextcloud fixed the flaw in richdocumentscode 26.4.303. SecurityOnline stresses that applying the patch does not remove webshells already in place, so a server that was exposed before the update can remain compromised afterward.
The patched release is richdocumentscode 26.4.303, so any installation below that version remains in the affected range. SecurityOnline is the only outlet cited for the technical analysis.
Checking for shx.php and shrf.php Webshells
The report advises administrators to update to 26.4.303 or later, or to remove the app. It also recommends checking for files matching shx.php and shrf.php under the app’s directory, killing suspicious www-data processes and rotating secrets.
The exposure is limited to servers that run the built-in CODE server app. The trigger condition, a CODE server that is not running, arises for example after a restart, so the vulnerable state does not require an unusual configuration. The entry point needs no credentials, and the first public signal came from operators who found webshells on their own servers, in the community alert and GitHub issue 354.
Self-Hosted Servers Face Full Compromise
SecurityOnline says self-hosted Nextcloud servers with the built-in CODE server can be fully compromised. Because the webshells run as the web server account, an attacker can reach anything that account can read, which is why the post-exploitation searches focused on password manager databases and wallet files stored on the same machine. The reporting names *.kdbx files, wallet.dat and keystore.json, along with Bitwarden and 1Password data and cryptocurrency directories.
Because the exploitation account rests on one outlet, the scale of the campaign is unknown. The report cites multiple operators but gives no count of compromised servers, no attribution to a threat actor and no confirmation from Nextcloud. Readers should treat the specifics as reported, not independently verified, until Nextcloud or a second source publishes its own findings.
