Nextcloud's built-in Collabora server flaw was exploited before disclosure

Nextcloud's built-in Collabora server flaw was exploited before disclosure

15 October 2026: Attackers have been planting webshells on self-hosted Nextcloud servers through CVE-2026-110447, a command injection flaw in the Collabora "Built-in CODE Server" app for Nextcloud, for about a month before the flaw was given a CVE. Collabora rates it critical, 9.2 on CVSS version 4. The fix is version 26.4.303 of the app, and Collabora says turning the app off is not enough: it has to be upgraded or removed.

Not yet independently verified. The number of compromised servers is unknown, and reports that ransomware operators use the flaw are unconfirmed. We read Collabora's advisory and blog, not a Nextcloud security bulletin. We will update this when it can be confirmed, and remove this note.

How the attack works

The app, known internally as richdocumentscode, bundles a copy of Collabora's online office suite inside Nextcloud so that home users and small teams can edit documents without running a separate server. The advisory says a request to the app's proxy.php endpoint can make the server run an operating system command as the web server user. No login and no user action are needed.

There is one condition. The attack works only while the bundled CODE server is not running, which happens during a container restart, an upgrade or after a crash. That window comes round on most servers sooner or later. Collabora adds that this is a different path from last year's CVE-2025-66208, and that the earlier fix does not block it.

Installations that do not use the built-in app are not affected. Collabora lists standalone Collabora Online servers, its Docker images, its RPM and DEB packages and the Nextcloud All-in-One images as safe. It describes the built-in app as "focused on home users" and used by a minority of Nextcloud users, and says no Collabora Online customer was affected. Sites still on Nextcloud 29 or older, which are out of support, should upgrade Nextcloud itself or remove the app.

A month between the fix and the CVE

BleepingComputer reports that the fix was committed on 9 September and version 26.4.303 released on 11 September, while the advisory and CVE appeared only on 14 October. Administrators told the site they had seen attacks from 10 September, and a community warning followed on 3 October. The attackers planted PHP webshells and searched for password databases, password manager files and cryptocurrency wallets.

Collabora blames the delay on the CVE process. Its blog says the time to get a GitHub CVE filed and published has gone from about a day to many weeks this year, under a flood of automated security reports, and that it is applying to become a CVE Numbering Authority itself. Nextcloud told BleepingComputer it had given users time to update and had not seen widespread exploitation.

Checking a server that ran the old version

Upgrading closes the hole but does not remove anything an attacker has already left behind. A server that ran a version below 26.4.303 and restarted its CODE server at any point since early September should be checked for PHP files that do not belong to Nextcloud or its apps, especially in web-writable folders, and for credentials stored on the machine that may need rotating. The upgrade also brings Landlock, a kernel-enforced sandbox for the document server.

We list Nextcloud and ONLYOFFICE, the other office suite commonly paired with it, and our file sharing software category holds 13 products.

Company profile on TrustList: Collabora Productivity

Update, 22 October 2026: NVD's record for CVE-2026-110447, published on 14 October, describes OS command injection in proxy.php that "allows remote code execution, as exploited in the wild in September and October 2026", fixed in 26.4.303, with a CVSS 4.0 score of 9.2. The earliest public victim report we found is a GitHub issue opened on 11 September.

Update, 24 October 2026: CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalogue on 23 October, with a remediation deadline of 26 October for US federal agencies and a requirement for forensic triage, which matches the advice above to look for planted files as well as upgrade.

Related on TrustList:

• SharePoint Server CVE-2026-65660 and WordPress CVE-2026-87902 are now exploited: check the August SharePoint update and WordPress 7.1.2

Sources

• Collabora Online security advisory GHSA-g3vx-3m76-fghh (GitHub), 14 October 2026
• Collabora blog: Stay Safe, Upgrade Everything Regularly, 15 October 2026
• BleepingComputer: Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers, 15 October 2026
• NVD: CVE-2026-110447 - 14 October 2026
• CISA: Known Exploited Vulnerabilities catalogue, CVE-2026-110447 added, 23 October 2026