Critical Nextcloud Collabora Built-in CODE Server Flaw Exploited, Web Shells Reported
Hackers are actively exploiting a critical vulnerability in the Collabora Online Built-in CODE Server app for Nextcloud, and administrators have reported finding web shells on compromised servers.
Identified as CVE-2026-110447, the flaw permits remote attackers to execute operating system commands without authentication. It affects the richdocumentscode app versions prior to 26.4.303 and carries a CVSS v4 score of 9.2.
The GitHub Advisory Database records exploitation of this vulnerability during September and October 2026. A warning posted to the Nextcloud community forum on October 3 noted that multiple users discovered web shells on their installations.
These uploaded scripts can let attackers run commands and retain access after the initial intrusion. Public reports so far do not attribute the attacks to a specific threat actor or disclose how many servers were breached.
How the vulnerability works
The bug is in proxy.php, a component that runs Collabora’s built-in document server within a Nextcloud deployment. According to Collabora’s advisory, a specially crafted request can force the server to execute an operating system command as the web server user. The issue is classified as CWE-78 (operating system command injection).
No account or user interaction is required to exploit the vulnerability. However, exploitation requires a particular condition: the built-in CODE server must not be running when the malicious request reaches the vulnerable code. That window can occur during a container restart, an application upgrade, or after a crash, creating an opportunity for attackers during otherwise routine maintenance.
Commands executed by attackers run with the permissions of the web server account rather than as root. Nevertheless, the GitHub advisory rates the potential impact to data privacy, file integrity, and service availability as high. The presence of web shells underlines the need for administrators to treat this as more than a routine update.
Scope and relationship to other issues
The vulnerability affects only the Collabora Online Built-in CODE Server app used inside Nextcloud; standalone Collabora Online servers are not vulnerable. Collabora confirms this exploitation path is distinct from CVE-2025-66208, and applying the earlier fix does not mitigate this issue. It is also unrelated to previously reported code execution flaws in the Nextcloud desktop client, which stemmed from unsafe URL handling rather than this server-side proxy.
Recommended actions for administrators
Administrators should upgrade the richdocumentscode app to version 26.4.303 or later, or remove the app entirely. Simply disabling the app does not guarantee protection against exploitation. Collabora also advises users running end-of-life Nextcloud releases (version 29 or earlier) to either upgrade Nextcloud itself or remove the affected app.
For systems that may already have been exposed, the community warning recommends searching for unexpected PHP files and other indicators of compromise. While installing the update closes the vulnerable entry point, it does not prove that an existing web shell has been removed; verifying and cleaning any intrusions should follow patching.
Update defenses against new malware as soon as it appears. Integrate threat intelligence feeds with data from operational SOCs to improve detection and response.
