Attackers exploit Collabora flaw to backdoor Nextcloud servers

Attackers are exploiting a command-injection flaw in Collabora Online - Built-in CODE Server, an optional Nextcloud app. The vulnerability, tracked as CVE-2026-110447, affects richdocumentscode versions before 26.4.303. Collabora says standalone Collabora Online servers, Docker and RPM/DEB installations, and Nextcloud All-in-One deployments are not affected.

The flaw is in how the app starts its bundled Collabora server. A malicious request to the app’s proxy.php endpoint can trigger operating-system command injection. Exploitation requires the built-in CODE server to be stopped, such as after a restart, upgrade, or crash. Authentication and user interaction are not required.

Multiple administrator reports describe attacks dating back to September 10. Attackers reportedly planted PHP webshells and searched for password databases, password manager artifacts, and cryptocurrency wallets. BleepingComputer could not independently confirm reports that ransomware operators are also exploiting the flaw.

Collabora committed a fix on September 9 and released version 26.4.303 on September 11. The advisory and CVE were published on October 14. Nextcloud told BleepingComputer that Collabora reported the flaw in mid-September and an update was available through the app store. Nextcloud said it delayed disclosure to give users time to update and because it had not observed widespread exploitation. Collabora attributed the delay primarily to GitHub CVE-processing backlogs.

Administrators are advised to upgrade to version 26.4.303 or later, or remove the app if it is not needed. Collabora warned that disabling it is insufficient.