Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
Attackers exploited CVE-2026-110447 in Nextcloud's optional Collabora CODE app to plant web shells.
Attackers exploited CVE-2026-110447 in Collabora's optional Nextcloud app, Collabora Online - Built-in CODE Server (richdocumentscode), to run commands and plant PHP web shells. The unauthenticated flaw in proxy.php works only when the local CODE server is not running, such as during a restart, upgrade, or crash, and affects every version before 26.4.303. The first logged attacks were on September 10, 2026; administrators saw shells named shx*.php and searches for password vaults and cryptocurrency wallets, with no confirmed root access or file exfiltration. Collabora says the app must be updated to 26.4.303 or later or removed; Nextcloud 29 and older cannot install that fix. Standalone Collabora Online is not affected, and the earlier CVE-2025-66208 fix does not block this issue.