richdocumentscode (Product): news timeline & CVEs

Hackers Exploit Critical Collabora Online Flaw to Backdoor Nextcloud Servers

Attackers are exploiting CVE-2026-110447 in Nextcloud's Collabora CODE app to plant web shells.

Attackers are exploiting CVE-2026-110447, a critical unauthenticated command-injection flaw in the Collabora Online Built-in CODE Server app (richdocumentscode) for Nextcloud. A crafted request to proxy.php can run OS commands as the web-server user when the built-in CODE server is not running, such as during a restart, upgrade, or crash. The issue, CWE-78 with CVSS v4 9.2, affects versions before 26.4.303; GitHub says it was exploited in September and October 2026, and Nextcloud users reported web shells. It is distinct from CVE-2025-66208, and disabling the app does not stop exploitation.

Cyber Security News05:24 UTC · 1h agoExploit / PoC in the wild 4 sources CVE-2026-110447 CVE-2025-662081

Critical Collabora Online Flaw Lets Attackers Execute Commands on Nextcloud Servers

Unauthenticated command injection CVE-2026-110447 in Nextcloud's built-in Collabora CODE Server can run commands as the web user.

Collabora Online disclosed CVE-2026-110447, an unauthenticated OS command injection (CWE-78) in proxy.php of richdocumentscode, the built-in CODE Server app for Nextcloud. A crafted network request can run commands as the web server user, but only while that built-in server is stopped, such as after a restart, upgrade, or crash. The CVSS v4 score is 9.2, and all releases before 26.4.303 are affected. Standalone Collabora Online is not affected, disabling the app is insufficient, the CVE-2025-66208 fix does not stop this issue, and no public exploitation was reported.

GBHackersupdated 05:24 UTC · 1h agofirst Oct 16, 09:19 UTC · 21h agoVulnerability 4 sources CVE-2026-110447 CVE-2025-66208

Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers

Attackers are exploiting CVE-2026-110447 in Nextcloud's built-in Collabora app to plant webshells and hunt credentials.

Threat actors are exploiting CVE-2026-110447, an unauthenticated OS command injection in Nextcloud's optional richdocumentscode app (Collabora Online built-in CODE server) before version 26.4.303. Exploitation hits proxy.php only when the bundled server is stopped; standalone Collabora, Docker, package installs, and Nextcloud All-in-One are unaffected. Reports dating to September 10 describe PHP webshells used to search for password databases, password-manager files, and cryptocurrency wallets. The fix was released September 11, but the advisory and CVE were published October 14; claimed ransomware use was not independently confirmed.

BleepingComputerupdated 05:24 UTC · 1h agofirst Oct 15, 20:25 UTC · 1d agoExploit / PoC in the wild 4 sources CVE-2026-110447

Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App

Attackers exploited CVE-2026-110447 in Nextcloud's optional Collabora CODE app to plant web shells.

Attackers exploited CVE-2026-110447 in Collabora's optional Nextcloud app, Collabora Online - Built-in CODE Server (richdocumentscode), to run commands and plant PHP web shells. The unauthenticated flaw in proxy.php works only when the local CODE server is not running, such as during a restart, upgrade, or crash, and affects every version before 26.4.303. The first logged attacks were on September 10, 2026; administrators saw shells named shx*.php and searches for password vaults and cryptocurrency wallets, with no confirmed root access or file exfiltration. Collabora says the app must be updated to 26.4.303 or later or removed; Nextcloud 29 and older cannot install that fix. Standalone Collabora Online is not affected, and the earlier CVE-2025-66208 fix does not block this issue.

The Hacker Newsupdated 05:24 UTC · 1h agofirst Oct 14, 17:38 UTC · 2d agoExploit / PoC in the wild 4 sources CVE-2025-66208

richdocumentscode

Timeline4 articles

Related CVEsby mentions

Appears with

Hackers Exploit Critical Collabora Online Flaw to Backdoor Nextcloud Servers

Critical Collabora Online Flaw Lets Attackers Execute Commands on Nextcloud Servers

Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers

Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App