---
title: Nextcloud’s Built-in Collabora App Exploited to Plant Backdoors
description: Critical Collabora CODE Server vulnerability CVE-2026-110447 exploited; upgrade to version 26.4.303 now to prevent web shell attacks.
canonical_url: https://codekeeper.co/ticker/collabora-code-server-vulnerability-cve-2026-110447
---

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks) | [Vulnerabilities](https://codekeeper.co/ticker/tag/vulnerabilities)

# Nextcloud’s Built-in Collabora App Exploited to Plant Backdoors

Critical Collabora CODE Server vulnerability CVE-2026-110447 exploited; upgrade to version 26.4.303 now to prevent web shell attacks.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Oct 19, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcollabora-code-server-vulnerability-cve-2026-110447%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcollabora-code-server-vulnerability-cve-2026-110447%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcollabora-code-server-vulnerability-cve-2026-110447%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcollabora-code-server-vulnerability-cve-2026-110447%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcollabora-code-server-vulnerability-cve-2026-110447%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcollabora-code-server-vulnerability-cve-2026-110447%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A critical flaw in Collabora Online – Built-in CODE Server, an optional app that runs Collabora’s document server inside Nextcloud, is being actively exploited, and admins have found web shells on compromised servers. The flaw, CVE-2026-110447 (CVSS v4 9.2, Critical), lets unauthenticated attackers run OS commands as the web server user through the app’s proxy.php file, with no account or user interaction needed. The CVE record confirms exploitation in September and October 2026. The attack window opens only when the CODE server isn’t running — during restarts, upgrades, or crashes. Standalone Collabora servers aren’t affected. Collabora fixed the flaw in richdocumentscode 26.4.303 on September 11. Admins should upgrade to that version or later, or remove the app entirely; disabling it alone won’t stop exploitation, and the earlier fix for CVE-2025-66208 doesn’t cover it. Servers on Nextcloud 29 or older can’t install the fix and need a Nextcloud upgrade or the app removed. Patching won’t remove a web shell that’s already in place. Admins whose servers were exposed should check for unexpected PHP files, starting with shx*.php files in the apps/richdocumentscode folder Source: [Cyber Security News](https://cybersecuritynews.com/hackers-exploit-critical-collabora-online-flaw/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcollabora-code-server-vulnerability-cve-2026-110447%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcollabora-code-server-vulnerability-cve-2026-110447%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcollabora-code-server-vulnerability-cve-2026-110447%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcollabora-code-server-vulnerability-cve-2026-110447%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcollabora-code-server-vulnerability-cve-2026-110447%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcollabora-code-server-vulnerability-cve-2026-110447%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks Critical Fortinet FortiMail Zero-Day Under Active Attack Oct 2, 2026](https://codekeeper.co/ticker/fortimail-zero-day-vulnerability-cve-2026-104286)

[Software security PHP Ships Emergency Fixes for PHP2Shell Flaws After Public PoC Oct 22, 2026](https://codekeeper.co/ticker/php-vulnerabilities-cve-2026-109618-cve-2026-109619)

[Japan's Military Unknowingly Used Chinese Malware-Infected USB Drives for Nearly a Year Aug 12, 2026](https://codekeeper.co/ticker/jgsdf-malware-infected-usb-drives-expose-classified-data)

[Vulnerabilities Unpatched Steam Flaw Gives Local Windows Users SYSTEM Access Sep 18, 2026](https://codekeeper.co/ticker/steam-zero-day-escalation-risk)