Flaw in Nextcloud’s Built-in Collabora CODE App Exploited to Plant Web Shells
Summary
Attackers exploited CVE-2026-110447 in the built-in Nextcloud CODE app to run commands and plant web shells when its local server was down. Collabora fixed versions before 26.4.303; users must update or remove the app.
Key points
- The flaw allowed unauthenticated command execution through the app’s proxy.php script when the local CODE server was not running.
- Three administrators reported attacks; logs from two servers showed malicious requests on September 10 and 11, 2026.
- Attackers planted PHP web shells and searched one server for credential stores and cryptocurrency wallets. Reviewed requests showed no file archiving or exfiltration commands, but readable data may have been exposed.
- The reports showed no attacker gaining root access; the total number of affected servers is unknown.
- Collabora fixed the flaw in version 26.4.303. Disabling the app is insufficient: users should update it or remove it.
- All versions before 26.4.303 are affected; standalone Collabora Online servers and Nextcloud installations without the built-in CODE app are not affected, according to the article.
- Nextcloud 29 and older are end of life, and the app store still serves them an affected version; users should upgrade Nextcloud or remove the app.
Article Details
- Vulnerability Types
- Command injection
- Severity
- Critical
- Affected Versions
- Collabora Online - Built-in CODE Server versions before 26.4.303
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Upgrade the app to version 26.4.303 or later, or remove it; disabling the app alone is not sufficient.
MITRE ATT&CK
T1059.004 · Unix ShellInjected request-path text was expanded and executed by bash as the web server user.T1083 · File and Directory DiscoveryAn attacker used the web shell to search the server for credential-store and cryptocurrency-wallet files.T1190 · Exploit Public-Facing ApplicationAttackers sent unauthenticated requests to exploit the vulnerable Nextcloud app's proxy.php script.T1505.003 · Web ShellAttackers placed PHP web shells in the app's folder to run commands through web requests.T1552.001 · Credentials In FilesAn attacker used the web shell to search for credential stores, including files matching *.kdbx and names such as bitwarden and 1password.
CVE
CVE-2025-66208or remove the app. Collabora's fix for a separate command-injection flaw in the same script, CVE-2025-66208, disclosed last December, does not prevent this one.CVE-2026-110447Collabora fixed it in version 26.4.303 on September 11 and on October 14 published an advisory with the identifier CVE-2026-110447, warning that turning off the app does not help: it must be updated or removed.
People
Vendors
CollaboraAttackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attackNextcloudAttackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack
Products
Collabora Online - Built-in CODE ServerAttackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attackCollabora Online Development Edition (CODE)The app, published by Collabora under the package name richdocumentscode, downloads a copy of Collabora Online Development Edition (CODE) and runs it on the Nextcloud server itself.NextcloudAttackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attackNextcloud OfficeThat lets Nextcloud Office edit documents without a separate Collabora server. Its store listing says it is "for local testing and non-production use" and "for personal use or for small teams."