Document-server RCE wave — Collabora CODE Server proxy.php pre-auth command injection (actively exploited) and ONLYOFFICE Document Builder runtime.json config bomb (Oct 14 03:30Z)¶

Source: hourly offensive-security scan of GitHub Security Advisories, 2026-10-14 (wave published 2026-10-14T03:30Z).

Two self-hosted document-conversion backends that sit behind Nextcloud, ownCloud, and collaborative-editing deployments both shipped pre-authenticated or low-privilege-to-RCE bugs in the same advisory minute — and one of them is confirmed exploited in the wild in September and October 2026 while still not in CISA KEV (checked against catalog 2026.10.13, 1741 entries). This is the ICSA-to-KEV head-start window pattern again, but the ITW signal is in the GHSA text itself.

Advisory table¶

Why this is worth an operator page¶

• Restart windows are attack surface with a schedule. The Collabora leg is only exploitable "when the CODE server isn't running (e.g., the product was recently restarted)." A privileged user restarting Nextcloud/collabora (or a deploy, or a crash-loop) opens a pre-auth command-injection door on proxy.php until the embedded server comes up. Durable rules: (1) enumerate per-deployment-shape variants of the same product — the advisory explicitly says standalone Collabora is not affected; only the Built-in CODE Server app. Recon question for any Nextcloud target: is the editor backend richdocumentscode (built-in, app-managed lifecycle, HTTP-fronted by proxy.php), a dedicated collabora container, or CODE-on-localhost? The vulnerable listener is reachable through the PHP app, so the target's normal 443 surface includes it. (2) Component-lifecycle gates are not stable gates — "the backend is down right now" is a transient state an attacker can wait for, poll for (banner/error-shape change on the proxy route), and in some cases cause (resource exhaustion, kill via an adjacent bug). Treat "only exploitable while X is down" advisories as standing risk, not mitigated risk. (3) ITW-before-KEV window: the GHSA says September–October 2026 exploitation; as of catalog 2026.10.13 this CVE is not in KEV. On authorized assessments of Nextcloud estates, richdocumentscode version < 26.4.303 is now a priority report item with an active-exploitation note, and unexplained editor-proxy requests in logs near a restart are a compromise-indicator candidate. Validation stays bounded: version/app-list evidence (/apps/richdocumentscode/, status.php) — no exploitation of live instances.
• A config file that a request can rewrite is a deferred-execution implant. The ONLYOFFICE leg is the config-bomb archetype: the injection point is converter XML (duplicate m_sFileTo = last-wins path override, a parser-duplicate-key bug), the write primitive lands on runtime.json (Document Builder's own executable path + arguments), and detonation is the next legitimate job. The attacker needs only an Inbox-compatible JWT — which every integrated storage platform (Nextcloud, ownCloud, Seafile integrations) provisions for its app user, and the Document Server trusts the JWT, not the human. Durable rules: (1) XML "path fields with duplicate-element override" is a grep-able class — any converter/export API that trusts server-side XML for its output path must reject duplicate path elements; the same shape produced the wiki's recurring validate-target-vs-write-target findings, here with a config target instead of a webshell. (2) Post-exploitation inventory for collaboration hosts: the ds service account, runtime.json/default.json config chains, and Document Builder binary paths are persistent-code-exec candidates that survive app upgrades unless the config is regenerated — on engagements, app-owned config files under /var/www///etc/ that are writable by the app user are standing RCE for whoever holds the app user or its JWT secret. (3) JWT secret review is the real fix check: JWT_SECRET in Document Server env is the whole authentication story for the Builder API; leaks via .env, docker inspect, or config dumps = attacker-grade access; verify integrators rotate it.
• Empty allowlists default to allow-all — in games too. Unreal's LaunchURL ships with an empty FURLRequestFilter, and "empty" means "no scheme blocked," not "no scheme allowed." Any UE title with user-generated Blueprints (Steam Workshop content, online-shared levels) executes arbitrary local/WebDAV files through the game's own URL launcher. Sweep rules for game/UGC engagements: (1) distinguish fail-closed vs fail-open empty config containers by probing the product with one disallowed-shaped input — file:///, smb://, http:// variants against any URL-launch/scheme-filter feature; (2) UGC content = untrusted code path even without network: if a mod/level can carry a Blueprint, the engine's whole capability surface (URL launch, file I/O, module load) is reachable from "downloaded a map"; (3) WebDAV as a remote file delivery channel matters again — file:// + Windows WebDAV mounts bring the attacker-supplied binary onto the victim's disk before ShellExecuteW runs it.

Validation workflow (authorized scope only)¶

• Collabora CODE Server: lab Nextcloud with richdocumentscode at a vulnerable version; confirm proxy.php is reachable through the front app URL, record the error-shape difference between CODE-running and CODE-stopped states (stop it via app config, not production traffic); never send command-injection payloads beyond a benign marker into lab proxy.php parameters. On live engagements: app-list/version/status evidence + log-review recommendations only.
• ONLYOFFICE: lab Document Server; mint a JWT with the lab JWT_SECRET; call builder.SaveFile() with a converter XML carrying two m_sFileTo elements where the second points at a disposable marker path outside the job dir (e.g., /tmp/oo-sink-canary.txt), verify write-then-config-override decision separately from runtime.json tampering; if testing the detonation leg, point the Builder binary at a script that writes a marker file. Never touch a runtime.json outside a disposable install.
• Unreal: desktop lab build; test scheme-filter behavior by launching a benign local text handler via file:/// in a lab Blueprint; do not distribute UGC test content outside the lab.

Evidence to capture: deployment-shape identification output, version/app-listing, lab write-path canary listing, and for ONLYOFFICE the duplicate-element request/response pair. Do not capture real JWT secrets, real user documents, or production config bodies.

Cross-references¶

• Deferred-detonation and config-relay family: Brocade deferred config-relay leg on the Oct 8 SAN wave; Nginx UI extractor-before-decide on the Oct 9 Nginx UI wave; W3TC deferred-import confused deputy on the Sept 19 alternate-surface page.
• Validate-target-vs-write-target upload/override invariant: Bricksforge parameter-pair leg on the Sept 19 shortcode page.
• ITW-before-KEV head-start precedent: RouterOS CVE-2026-84411 tracking on the Sept 15 KEV page; NetScaler 88779 24-hour KEV fast-follow note on the same page — watch whether CVE-2026-110447 gets KEV'd.
• Editor-suite sibling history: ONLYOFFICE Docs 2021 path-traversal was KEV-backfilled 2026-10-08 (catalog entry) — this product line is now a repeat-offender class for the wiki; Zimbra's twelve-KEV mail-suite precedent shows how collaboration platforms accumulate exploitation history.