Actively Exploited Collabora RCE Leaves Nextcloud Servers Backdoored
Read Time:3 Minute, 26 Second
Attackers are exploiting a critical command-injection vulnerability in the Collabora Onli
Altro...
Read Time:3 Minute, 26 Second
Attackers are exploiting a critical command-injection vulnerability in the Collabora Onli
Altro...Read Time:3 Minute, 26 Second
Attackers are exploiting a critical command-injection vulnerability in the Collabora Online Built-in CODE Server app for Nextcloud, and compromised administrators have reported finding web shells on their servers. The flaw, tracked as CVE-2026-110447, can let a remote, unauthenticated attacker execute operating-system commands as the web server account.
The vulnerability affects versions of the richdocumentscode app earlier than 26.4.303 and carries a CVSS v4 score of 9.2. The GitHub Advisory Database records exploitation during September and October 2026, while an October 3 community warning described unexpected web shells discovered on affected Nextcloud systems. No public report has attributed the activity to a named group or established the total number of compromised servers.
A command injection in the built-in document serverThe vulnerable code is in proxy.php, which supports operation of Collabora’s bundled document server inside a Nextcloud deployment. A specially crafted request can cause the server to pass an attacker-controlled operating-system command for execution. The weakness is classified as CWE-78, the standard category for improper neutralization of commands.
No account or victim click is required, but exploitation has an important precondition: the built-in CODE server must not be running when the malicious request reaches the vulnerable path. That situation can occur during a container restart, an application upgrade or recovery after a crash. Routine operational transitions can therefore create the window an attacker needs.
Successful commands execute with the web server user’s privileges rather than automatically receiving root access. That limitation does not make the outcome harmless. The application account may be able to read or alter sensitive web content, access configuration material, disrupt the service or install a web shell that preserves remote command access after the initial exploit.
The affected scope is specific—but disabling is insufficientCVE-2026-110447 affects the Collabora Online Built-in CODE Server app, not every Nextcloud or Collabora installation. Standalone Collabora Online servers are outside the affected scope. The vulnerability also uses a different attack path from CVE-2025-66208, meaning the fix for that earlier issue does not protect against this one.
Administrators should upgrade richdocumentscode to version 26.4.303 or later. If upgrading is not possible, the vulnerable app should be removed. Simply disabling the app does not block exploitation. Organizations still running end-of-life Nextcloud 29 or earlier should upgrade the broader Nextcloud installation or remove the affected component.
Identify every internet-reachable Nextcloud instance and inventory its installed app version.
Upgrade to richdocumentscode 26.4.303 or newer, or fully remove the component.
Do not rely on toggling the app off as a compensating control.
Review web roots and writable directories for unexpected PHP files or recent modifications.
Preserve logs and suspicious artifacts before cleanup so investigators can reconstruct activity.
Patching does not remove an existing web shellBecause exploitation has already been observed, exposed organizations need to treat this as both a vulnerability-management and incident-response problem. Updating closes the known entry point, but it does not erase a payload already written to disk, revoke a stolen secret or undo changes made through a shell.
Responders should examine web-server access and error logs around restarts, upgrades and crashes; compare application files with known-good packages; inspect recently created or modified PHP files; and look for child processes or outbound connections launched by the web server account. Any confirmed compromise should trigger credential rotation for secrets accessible to that account and a broader assessment of lateral movement.
Teams should be cautious about restoring only the visibly altered file. A web shell is evidence that the attacker obtained a command channel, and additional persistence may exist elsewhere. Rebuilding from a trusted image may be safer than piecemeal cleanup when the integrity of the host cannot be established.
The narrow condition required for exploitation may sound reassuring, but internet-facing services restart frequently enough that determined scanning can catch the vulnerable state. With real-world exploitation and backdoors already reported, administrators should prioritize the fixed app version and complete a compromise review without waiting for more detailed attribution.
