Hackers Exploit Critical Collabora Online Flaw to Backdoor Nextcloud Servers
Attackers are exploiting CVE-2026-110447 in Nextcloud's Collabora CODE app to plant web shells.
Attackers are exploiting CVE-2026-110447, a critical unauthenticated command-injection flaw in the Collabora Online Built-in CODE Server app (richdocumentscode) for Nextcloud. A crafted request to proxy.php can run OS commands as the web-server user when the built-in CODE server is not running, such as during a restart, upgrade, or crash. The issue, CWE-78 with CVSS v4 9.2, affects versions before 26.4.303; GitHub says it was exploited in September and October 2026, and Nextcloud users reported web shells. It is distinct from CVE-2025-66208, and disabling the app does not stop exploitation.
78