Attackers exploit unauthenticated command injection flaw in Nextcloud Collabora app

Threat actors are abusing a critical vulnerability in the Collabora Online Built-in CODE Server app to install web shells and gain remote access to Nextcloud infrastructure.

Threat Times Exposure DeskOctober 18, 20262 min read

Share LinkedIn Reddit

Illustration: A sleek white server sits on a cluttered desk, its single green status light blinking steadily. — AI-generated illustration: Threat Times

Key points

CVE-2026-110447 allows remote code execution without authentication in richdocumentscode versions before 26.4.303.
Attackers exploited the flaw during September and October 2026, leaving malicious scripts on affected servers.
Standalone Collabora Online servers are not affected by this specific proxy-based vulnerability.

Remote attackers have successfully exploited a critical vulnerability in the Collabora Online Built-in CODE Server app for Nextcloud to install web shells and gain unauthorized command execution on servers, according to Cyber Security News. The flaw, tracked as CVE-2026-110447, allows threat actors to run operating system commands without needing to log in, creating a significant security risk for administrators who rely on this integrated document viewing and editing solution.

The vulnerability carries a CVSS v4 score of 9.2, indicating severe potential impact on data privacy, file integrity, and service availability. It specifically affects the richdocumentscode app in versions prior to 26.4.303. According to the GitHub Advisory Database, attackers actively exploited this weakness throughout September and October 2026. A warning posted to the Nextcloud community forum on October 3 alerted users that they had discovered web shells on their compromised systems, confirming real-world abuse of the issue.

Technical Details and Exploitation Conditions

The vulnerability resides in the proxy.php file, which is part of the application that runs Collabora’s built-in document server within a Nextcloud deployment. Collabora’s security advisory explains that a specially crafted request can trigger the server to execute an operating system command as the web server user. This issue is classified as CWE-78, or operating system command injection. While commands execute with the permissions of the web server account rather than automatically as root, the reported presence of web shells demonstrates that attackers can maintain persistent access after the initial break-in.

Exploitation requires a specific condition: the built-in CODE server must not be running when the malicious request reaches the vulnerable code. This state can occur during container restarts, software upgrades, or following a crash. These scenarios create temporary attack windows during routine maintenance or unexpected failures, allowing attackers to bypass authentication entirely. No user interaction is required for the exploit to succeed.

Scope and Distinction from Previous Flaws

This vulnerability affects the Collabora Online Built-in CODE Server app specifically, rather than every Nextcloud or Collabora installation. Standalone Collabora Online servers are not impacted by this proxy-based flaw. Collabora confirms that this is a distinct attack path from CVE-2025-66208, and installing the fix for that earlier vulnerability does not block exploitation of CVE-2026-110447. It is also separate from previously reported Nextcloud desktop client code execution flaws, which involved unsafe URL handling rather than this server-side proxy issue.

The attack does not rely on stolen credentials, distinguishing it from infostealer-driven cloud breaches discussed in earlier Cyber Security News coverage. Available reports do not identify a specific threat group responsible for the exploitation or state how many servers were breached. As Threat Times reported on 2026-10-17, hackers have been abusing critical vulnerabilities in this app to gain command execution, with the current wave of activity confirming the ongoing nature of the threat.

What should you do?

Administritors should verify their Nextcloud installations are running richdocumentscode version 26.4.303 or later, as this version addresses the identified command injection flaw. Users should monitor server logs for unusual activity, particularly during maintenance windows when the CODE server might be temporarily offline. Security teams should treat the discovery of any unknown web shells as a critical incident requiring immediate investigation and remediation.

What to do and how to stay safe

Verify that the richdocumentscode app is updated to version 26.4.303 or newer on all Nextcloud servers.
Monitor server logs for unexpected command executions, especially during container restarts or upgrades.
Scan for and remove any unauthorized web shells or malicious scripts found on the system.
Review access controls to ensure the web server user has minimal necessary permissions.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.