Hackers Exploit Nextcloud Collabora Flaw to Install Web Shells on Servers
Attackers abused a critical vulnerability in the Built-in CODE Server app to gain command execution on Nextcloud installations, according to reports.
Key points
- Attackers exploited CVE-2026-110447 in Collabora Online Built-in CODE Server versions prior to 26.4.303.
- The flaw allows unauthenticated command execution when the local document server is not running.
- Disabling the application does not mitigate the risk; administrators must update or remove the package entirely.
Hackers exploited a vulnerability in Nextcloud’s optional Collabora Online Built-in CODE Server application to deploy web shells on user servers, according to a report by The Hacker News. Three system administrators documented the issue on GitHub, noting that the earliest recorded attack occurred on September 10.
The vulnerability, identified as CVE-2026-110447, enables an attacker to send an unauthenticated request that executes arbitrary commands on the server. This exploit functions only when the app’s local document server is inactive, such as during a restart, an upgrade process, or following a crash. The executed commands run with the privileges of the web server account.
Technical Context and Fixes
Collabora released a fix in version 26.4.303 on September 11 and published an advisory on October 14. The company warned that merely disabling the application within Nextcloud is insufficient to stop the attack. Administrators must upgrade to version 26.4.303 or later or completely remove the `richdocumentscode` package from their systems.
The flaw exists in the `proxy.php` script included in the app. This script attempts to start the local Collabora Online Development Edition (CODE) server when incoming requests find no listener. In versions up to 26.4.302, the script inserted request path data into a double-quoted bash command. Because the shell interprets `$(...)` sequences within those quotes, an attacker could hide a command in the URL path to execute it as the web server user.
Collabora’s advisory states that the issue affects all versions before 26.4.303. Standalone Collabora Online servers are not affected by this specific vulnerability. The fixed versions of the app require Nextcloud 30 or a later version to function correctly.
Affected Configurations
The Built-in CODE Server app downloads and runs CODE directly on the Nextcloud server, allowing document editing without a separate Collabora instance. Its store listing describes it as suitable for local testing, personal use, or small teams. According to a warning posted on the Nextcloud community forum on October 3, installations using only the standard Nextcloud Office app (`richdocuments`) are not affected.
This safe configuration applies whether the Collabora server runs in Docker, via a Linux package, or through a hosting provider. The risk is isolated to systems that have enabled the optional Built-in CODE Server feature. The `proxy.php` script is a plain PHP file executed directly from the app’s folder and does not load any other Nextcloud code.
What should you do?
Administrators should immediately check their Nextcloud instances to determine if the Collabora Online Built-in CODE Server is installed. If the app is present, verify the current version against the fixed release 26.4.303. Systems running older versions are vulnerable to command execution during server downtime.
Users who do not require the built-in server should consider removing the `richdocumentscode` package entirely. If removal is not possible, updating to the latest version is required. Those relying on the standard Nextcloud Office app with an external server do not need to take action regarding this specific flaw.
What to do and how to stay safe: Nextcloud
- Check Nextcloud app lists for the presence of "Collabora Online - Built-in CODE Server" or package name "richdocumentscode".
- Verify the installed version of the app; update to 26.4.303 or higher if it is older.
- Remove the app entirely if the feature is not required for your workflow.
- Monitor server logs for unusual command execution or web shell activity during maintenance windows.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does disabling the Collabora Built-in CODE Server fix the vulnerability?
No, Collabora states that disabling the app is insufficient; you must update to version 26.4.303 or remove it.
Are standalone Collabora Online servers affected by CVE-2026-110447?
No, the advisory specifies that standalone servers are not affected by this flaw.
What versions of Nextcloud are required for the fix?
The fixed versions of the app require Nextcloud 30 or later.
