A critical remote code execution vulnerability, tracked as CVE-2026-110447 (CVSS 9.2), is actively exploited against Nextcloud deployments using the Collabora Online Built-in CODE Server app (richdocumentscode). The flaw resides in apps/richdocumentscode/proxy.php. When incoming HTTP requests hit the proxy while the document server daemon is stopped—such as after server reboots or crashes—the script dynamically restarts the daemon using an unescaped shell string. Unauthenticated attackers supply crafted request paths containing shell evaluation syntax ($(...)) to execute arbitrary commands under the web server’s www-data context.

Threat actors have weaponized this flaw to drop persistent PHP web shells (sh*.php) directly into the app directory, siphoning database credentials, environment variables, and password stores. While Collabora patched the issue in version 26.4.303 by strictly parameterizing binary execution, simply disabling the app in Nextcloud leaves proxy.php accessible on disk. Organizations must upgrade to 26.4.303 or delete the app directory entirely.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Standalone helper scripts bypassing framework authentication create unmonitored execution vectors, allowing unauthenticated adversaries to abuse service-restart routines for arbitrary command injection and root-adjacent web shell persistence.
• Bullet 2 — Strategic & Defender Imperative: Security teams must audit Nextcloud web roots for dormant application files, inspect access logs for anomalous proxy.php requests, and enforce strict filesystem write restrictions on web server runtime directories.