GajShield Threat Advisory — Nextcloud Collabora Built-in CODE Command Injection (CVE-2026-110447)

Severity: Critical | Priority: 1

The “Collabora Online – Built-in CODE Server” app for Nextcloud (richdocumentscode) has an unauthenticated command injection flaw in its proxy.php script. Versions up to and including 26.4.302 are affected, and the flaw is rated CVSS v4 9.2. When the built-in CODE server isn’t running, for example during a restart, update or crash, proxy.php starts it by building a shell command that includes text from the request. A crafted request can therefore run commands as the web server account.

Attacks have been seen since September 10, 2026. Attackers plant a small PHP web shell named like shx*.php or shrf*.phpin the app’s folder, then use it to run further commands. They have searched for password vaults (.kdbx) and cryptocurrency wallets. Standalone Collabora Online servers and Nextcloud Office setups that don’t use the Built-in CODE app are not affected.

If an exploit alert is raised, treat the destination Nextcloud server as possibly compromised. On that server:

1. Check the installed richdocumentscode version.
2. Look in apps/richdocumentscode (or custom_apps/richdocumentscode) for any shx*.php or shrf*.php files.
3. Search the web server access logs since September 10 for requests to proxy.php that contain %2e%2e, $(, ${IFS} or base64.