Science & Tech · Cybersecurity · 5 hrs ago
Hackers exploit Collabora flaw to backdoor some Nextcloud servers
Attackers exploited a flaw in Nextcloud’s built-in Collabora app to plant web shells on some servers.
The vulnerable app, called richdocumentscode, runs a local Collabora document server within Nextcloud.
The flaw let unauthenticated requests run commands when that local server was stopped, such as after a restart, upgrade or crash.
Administrators reported attacks from September 10, while Collabora released a fix on September 11 and published its advisory on October 14.
Only the optional built-in app is affected; standalone Collabora servers and other deployment types described by Collabora are not.
Attackers used web shells to search some servers for password stores and cryptocurrency wallets, though reports of ransomware activity have not been independently confirmed.
Admins should update to version 26.4.303 or later, or remove the app; disabling it alone does not protect a server.
Hackers exploited a command-execution flaw in Collabora’s optional built-in CODE Server app for Nextcloud to plant PHP web shells.
The flaw, tracked as CVE-2026-110447, affects versions before 26.4.303 and can be exploited without authentication when the local document server is not running.
Administrators reported attacks beginning on September 10, before the vulnerability advisory and CVE were published on October 14.
Collabora said administrators must update the app to version 26.4.303 or later or remove it; simply disabling it is insufficient.
Standalone Collabora Online servers and Nextcloud deployments without the built-in app are not affected, according to the sources.
- Who
- Attackers targeted servers running Nextcloud’s optional Collabora Online - Built-in CODE Server app.
- What
- They exploited a command-injection flaw to run commands and plant PHP web shells.
- When
- Reported attacks began on September 10, 2026; the advisory and CVE were published on October 14.
- Where
- On affected Nextcloud servers running the built-in CODE Server app.
- Why
- The flaw let an unauthenticated request run commands when the local document server was not running. The attackers’ broader motives are not stated.
Nextcloud
Collabora
Disclosure delay
Nextcloud
Nextcloud said it delayed disclosure to give users time to update and because it had not observed widespread exploitation.
Collabora
Collabora attributed the delay primarily to GitHub CVE-processing backlogs amid rising volumes of AI-driven security reports.
Collabora committed a fix for the flaw.
An administrator’s first logged attack occurred, according to reports cited by The Hacker News.
Collabora released version 26.4.303 with the fix.
A warning on the Nextcloud community forum urged administrators to update.
Collabora published an advisory and the vulnerability received the identifier CVE-2026-110447.
- Vulnerability
- CVE-2026-110447
- Affected app
- richdocumentscode, Collabora Online - Built-in CODE Server
- Fixed version
- 26.4.303
- First reported attack
- September 10, 2026
- Advisory date
- October 14, 2026
- Exploit condition
- The built-in CODE server must be stopped or not running
3 sources
What people are saying
It is not sufficient to disable the app to avoid the problem; it must be upgraded to >= 26.4.303 or removed