Cyberattacks | Vulnerabilities

Nextcloud’s Built-in Collabora App Exploited to Plant Backdoors

Critical Collabora CODE Server vulnerability CVE-2026-110447 exploited; upgrade to version 26.4.303 now to prevent web shell attacks.

By Content Team

Oct 19, 2026

ON THIS PAGE

A critical flaw in Collabora Online – Built-in CODE Server, an optional app that runs Collabora’s document server inside Nextcloud, is being actively exploited, and admins have found web shells on compromised servers. The flaw, CVE-2026-110447 (CVSS v4 9.2, Critical), lets unauthenticated attackers run OS commands as the web server user through the app’s proxy.php file, with no account or user interaction needed.

The CVE record confirms exploitation in September and October 2026. The attack window opens only when the CODE server isn’t running — during restarts, upgrades, or crashes. Standalone Collabora servers aren’t affected.

Collabora fixed the flaw in richdocumentscode 26.4.303 on September 11. Admins should upgrade to that version or later, or remove the app entirely; disabling it alone won’t stop exploitation, and the earlier fix for CVE-2025-66208 doesn’t cover it. Servers on Nextcloud 29 or older can’t install the fix and need a Nextcloud upgrade or the app removed.

Patching won’t remove a web shell that’s already in place. Admins whose servers were exposed should check for unexpected PHP files, starting with shx*.php files in the apps/richdocumentscode folder

Source: Cyber Security News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?