Threat Intelligence

Nextcloud Servers Backdoored Through Flaw in Optional Built-in Collabora App

The Hacker News · 15 Oct 2026

Key Takeaway If your Nextcloud server uses the built-in Collabora CODE app, update it to version 26.4.303 or later or remove it (disabling is not enough), and check the server for unexpected files.

Attackers have exploited a critical flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server (package name richdocumentscode), to install web shells on Nextcloud servers. A web shell is a small file that lets an attacker run any command on the server through a web request, with the rights of the web server account. Three administrators reported the issue on GitHub, and the first logged attack was on September 10.

The flaw lets an unauthenticated request run a command on the server, but only while the app's local document server is not running, for example during a restart, an upgrade or after a crash. Collabora fixed the problem in version 26.4.303 on September 11, and on October 14 published an advisory under the identifier CVE-2026-110447. It covers every version before 26.4.303 and warns that disabling the app is not enough: it must be upgraded or removed. The fixed versions require Nextcloud 30 or later.

Not every installation is exposed. Collabora says standalone Collabora Online servers are not affected. A Nextcloud community forum warning on October 3 said setups using only the Nextcloud Office app (richdocuments), without the built-in app, are also unaffected, whether the Collabora server runs in Docker, from a Linux package or at a hosting provider. The built-in app's store listing describes it as for local testing, non-production use, personal use or small teams.

Nextcloud Collabora web shell CVE-2026-110447 patching

Summarised by CISO AI from The Hacker News, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.