Hackers Exploit Critical Collabora Online Flaw to Backdoor Nextcloud Servers

Hackers are exploiting a critical flaw in the Collabora Online Built-in CODE Server app for Nextcloud, with users reporting web shells on compromised servers.

Tracked as CVE-2026-110447, the vulnerability allows remote attackers to run operating system commands without logging in. It affects the richdocumentscode app before version 26.4.303 and carries a CVSS v4 score of 9.2.

The GitHub Advisory Database entry states that attackers exploited the flaw during September and October 2026. An October 3 warning on the Nextcloud community forum reported that users had found web shells on their servers.

These malicious scripts can let attackers run commands and maintain access after the initial break-in. Available reports do not identify a specific threat group or state how many servers were breached.

The flaw sits in proxy.php, part of the app that runs Collabora’s built-in document server inside a Nextcloud deployment. According to Collabora’s security advisory, a crafted request can cause the server to execute an operating system command as the web server user. The issue is classified as CWE-78, or operating system command injection.

Attackers do not need an account, and no user interaction is required. However, exploitation depends on one important condition. The built-in CODE server must not be running when the malicious request reaches the vulnerable code. This can happen during a container restart, an upgrade, or after a crash, creating an attack window during otherwise routine maintenance.

Hackers Exploit Collabora Online Flaw

Commands run with the permissions of the web server account, not automatically as root. Even so, the Github advisory rates the potential impact on data privacy, file integrity, and service availability as high. The reported web shells show why affected administrators should treat this as more than a software update task.

The issue affects the Collabora Online Built-in CODE Server app, rather than every Nextcloud or Collabora installation. Standalone Collabora Online servers are not affected.

Collabora also confirms that this is a different attack path from CVE-2025-66208, and installing the earlier vulnerability’s fix does not block this exploit.

Unlike the credential theft discussed in Cyber Security News’ coverage of infostealer-driven cloud breaches, this attack needs no stolen password.

It is also separate from previously reported Nextcloud desktop client code execution flaws, which involved unsafe URL handling rather than this server-side proxy.

Administrators should upgrade richdocumentscode to version 26.4.303 or later, or remove it. Turning off the app alone does not prevent exploitation. According to Collabora, users running end-of-life Nextcloud versions 29 or earlier should upgrade Nextcloud or remove the affected app.

For previously exposed systems, the community warning also recommends checking for unexpected PHP files. Updating closes the vulnerable entry point, but should not be treated as proof that an existing web shell has been removed. Reported compromises make checking for signs of intrusion an important follow-up to patching.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.