Attackers Exploit Collabora Code-Execution Flaw in Nextcloud’s Built-In Server App

Summary

Attackers are exploiting CVE-2026-110447 in Nextcloud’s optional built-in Collabora CODE app. Versions before 26.4.303 are affected; administrators should upgrade or remove the app. Some ransomware exploitation reports remain unconfirmed.

Key points

• The command-injection flaw affects richdocumentscode versions before 26.4.303 and is triggered through the app’s proxy.php endpoint.
• Successful exploitation requires the built-in CODE server to be stopped; authentication and user interaction are not required.
• Standalone Collabora servers, Docker and RPM/DEB installations, and Nextcloud All-in-One deployments are reported unaffected.
• Administrators reported attacks beginning in mid-September, with attackers planting PHP webshells and searching for password databases, password-manager artifacts, and cryptocurrency wallets.
• Reports of ransomware operators exploiting the flaw could not be independently confirmed by BleepingComputer.
• The fix was committed September 9 and version 26.4.303 was released September 11; the advisory and CVE were published October 14.
• Administrators should upgrade to version 26.4.303 or later, or remove the app if unnecessary; disabling it alone is insufficient.

MITRE ATT&CK

CVE

Vendors

Products

Related Articles

• Flaw in Nextcloud’s Built-in Collabora CODE App Exploited to Plant Web ShellsCVE-2026-110447 · Collabora Online - Built-in CODE Server · Nextcloud
• Unattended Hermes AI Agent Used in Targeting of Thailand Finance Ministry, Researchers FindT1059 · T1083 · T1505.003
• Leaked Documents Reveal APT35’s Espionage Operations, Tooling and Victim DataNextcloud · T1505.003
• PhantomCore Campaign Compromises 181 Russian Hosts in Cyberespionage OperationNextcloud · T1083
• AhsayCBS Fixes Two Flaws Exploited to Deploy Web Shells and XMRig MinersT1059 · T1505.003