Critical Collabora Online flaw exploited to backdoor Nextcloud servers

Key Takeaways

• A critical vulnerability (CVE-2026-110447) in the Collabora Online Built-in CODE Server app for Nextcloud is being actively exploited.
• Attackers are deploying web shells on compromised Nextcloud servers, enabling remote command execution and persistent access.
• The flaw allows unauthenticated, remote operating system command injection with a CVSS v4 score of 9.2.
• The vulnerability affects the richdocumentscode app prior to version 26.4.303.
• Immediate patching to version 26.4.303 or later, or removal of the app, is strongly recommended, followed by a thorough scan for compromise.

Critical Vulnerability in Collabora Online App Exploited on Nextcloud Servers

Cybersecurity researchers and users are reporting active exploitation of a severe vulnerability within the Collabora Online Built-in CODE Server app, specifically impacting Nextcloud deployments. This critical flaw, identified as CVE-2026-110447, enables unauthenticated remote attackers to execute arbitrary operating system commands, leading to the deployment of web shells on affected servers.

The vulnerability affects the richdocumentscode app in versions preceding 26.4.303 and has been assigned a high-severity CVSS v4 score of 9.2. Reports indicate that malicious activity leveraging this flaw occurred throughout September and October 2026. A community forum alert from Nextcloud on October 3 confirmed that users had discovered web shells on their compromised systems.

Understanding the Exploitation and Impact

Web shells are malicious scripts that grant attackers persistent remote access and the ability to execute commands on a compromised server, effectively maintaining control after the initial breach. While specific threat actors or the total number of breached servers have not yet been identified, the presence of these tools underscores the severe implications of successful exploitation.

The core of the vulnerability resides in the proxy.php component of the richdocumentscode app, which is responsible for integrating Collabora’s document server within a Nextcloud environment. According to Collabora’s security advisory, a specially crafted request can trick the server into executing an operating system command under the privileges of the web server user. This issue is categorized as CWE-78, a common type of operating system command injection.

Exploitation of this vulnerability requires no prior authentication or user interaction. However, a specific condition must be met for the attack to succeed: the built-in CODE server must not be actively running when the malicious request is processed. This scenario can arise during routine maintenance operations such as container restarts, software upgrades, or after a system crash, creating a critical window of opportunity for attackers.

Although commands are executed with web server account permissions rather than root, the potential impact on data privacy, file integrity, and service availability is rated as high by the Github advisory. The confirmed deployment of web shells highlights that this issue extends beyond a simple software update, demanding a comprehensive security response from affected administrators.

Distinction from Other Vulnerabilities

It’s important to note that this vulnerability specifically targets the Collabora Online Built-in CODE Server app and does not affect all Nextcloud or Collabora Online installations. Standalone Collabora Online servers are explicitly not impacted. Collabora has also confirmed that CVE-2026-110447 represents a distinct attack vector from CVE-2025-66208, meaning that applying patches for the earlier vulnerability will not mitigate this new threat. Furthermore, this server-side proxy flaw is separate from previously reported Nextcloud desktop client code execution vulnerabilities that involved unsafe URL handling.

What You Should Do

• Immediate Patching: Upgrade the richdocumentscode app to version 26.4.303 or newer without delay.
• App Removal: If immediate patching is not feasible, remove the richdocumentscode app entirely. Simply disabling the app is insufficient to prevent exploitation.
• End-of-Life Systems: For Nextcloud versions 29 or earlier that have reached end-of-life, administrators must either upgrade their Nextcloud instance or remove the affected Collabora app.
• Post-Patch Scan: After patching, thoroughly check your server for any unexpected PHP files or other signs of compromise, as updating the app closes the entry point but does not remove existing web shells.
• Monitor Logs: Review server logs for unusual activity, especially around the times of container restarts, upgrades, or crashes.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.