Collabora Online (Product): news timeline & CVEs

Hackers Exploit Critical Collabora Online Flaw to Backdoor Nextcloud Servers

Attackers are exploiting CVE-2026-110447 in Nextcloud's Collabora CODE app to plant web shells.

Attackers are exploiting CVE-2026-110447, a critical unauthenticated command-injection flaw in the Collabora Online Built-in CODE Server app (richdocumentscode) for Nextcloud. A crafted request to proxy.php can run OS commands as the web-server user when the built-in CODE server is not running, such as during a restart, upgrade, or crash. The issue, CWE-78 with CVSS v4 9.2, affects versions before 26.4.303; GitHub says it was exploited in September and October 2026, and Nextcloud users reported web shells. It is distinct from CVE-2025-66208, and disabling the app does not stop exploitation.

Cyber Security News05:24 UTC · 1h agoExploit / PoC in the wild 4 sources CVE-2026-110447 CVE-2025-662081

Critical Collabora Online Flaw Lets Attackers Execute Commands on Nextcloud Servers

Unauthenticated command injection CVE-2026-110447 in Nextcloud's built-in Collabora CODE Server can run commands as the web user.

Collabora Online disclosed CVE-2026-110447, an unauthenticated OS command injection (CWE-78) in proxy.php of richdocumentscode, the built-in CODE Server app for Nextcloud. A crafted network request can run commands as the web server user, but only while that built-in server is stopped, such as after a restart, upgrade, or crash. The CVSS v4 score is 9.2, and all releases before 26.4.303 are affected. Standalone Collabora Online is not affected, disabling the app is insufficient, the CVE-2025-66208 fix does not stop this issue, and no public exploitation was reported.

GBHackersupdated 05:24 UTC · 1h agofirst Oct 16, 09:19 UTC · 21h agoVulnerability 4 sources CVE-2026-110447 CVE-2025-66208

Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers

Attackers are exploiting CVE-2026-110447 in Nextcloud's built-in Collabora app to plant webshells and hunt credentials.

Threat actors are exploiting CVE-2026-110447, an unauthenticated OS command injection in Nextcloud's optional richdocumentscode app (Collabora Online built-in CODE server) before version 26.4.303. Exploitation hits proxy.php only when the bundled server is stopped; standalone Collabora, Docker, package installs, and Nextcloud All-in-One are unaffected. Reports dating to September 10 describe PHP webshells used to search for password databases, password-manager files, and cryptocurrency wallets. The fix was released September 11, but the advisory and CVE were published October 14; claimed ransomware use was not independently confirmed.

BleepingComputerupdated 05:24 UTC · 1h agofirst Oct 15, 20:25 UTC · 1d agoExploit / PoC in the wild 4 sources CVE-2026-110447

Collabora Online

Timeline3 articles

Related CVEsby mentions

Appears with

Hackers Exploit Critical Collabora Online Flaw to Backdoor Nextcloud Servers

Critical Collabora Online Flaw Lets Attackers Execute Commands on Nextcloud Servers

Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers