Vulnerabilities · Application Security
Hackers exploit Collabora flaw to backdoor Nextcloud servers
A critical flaw in Collabora's CODE server for Nextcloud is being used to install backdoors. Admins are urged to update as attacks began weeks before the official warning.
Ross Grant3 min read
The short version
A serious bug in an add-on for Nextcloud, a popular file sharing platform, is being used by hackers to take control of servers. The bug lets attackers run commands on the server without needing a password, but only if a certain part of the software is stopped. Admins should update the software right away to stay safe. The full impact is not yet clear, as only one news outlet has reported on the attacks so far.
What happened?
Hackers have exploited a critical remote code execution flaw (CVE-2026-110447) in the Collabora Online - Built-in CODE Server app for Nextcloud. Attacks began in mid-September 2026, before the flaw was officially disclosed. Attackers used the flaw to install backdoors and search for sensitive files. Only the optional built-in CODE server app is affected.
What is the Collabora CODE server vulnerability?
A serious security flaw, tracked as CVE-2026-110447, has been found in the Collabora Online - Built-in CODE Server app (also called richdocumentscode) for Nextcloud. This app lets users work on documents in their browser. The vulnerability allows attackers to run commands on the server without needing a password or any user action, but only if the built-in CODE server is stopped (for example, after a restart or crash). The flaw only affects the optional built-in CODE server app. Standalone Collabora servers, Docker or RPM/DEB installations, and Nextcloud All-in-One are not affected, according to Collabora.BleepingComputer (opens in a new tab)
How were servers attacked?
According to administrator reports, attacks started around 10 September 2026, about a month before the official security bulletin and CVE were published. Attackers sent malicious requests to the app’s proxy.php endpoint, exploiting the flaw to inject operating system commands. Once inside, they planted PHP webshells (small programs that let attackers control the server remotely). They then searched for password databases, password manager files, and cryptocurrency wallets. Some users also reported ransomware activity, but BleepingComputer could not confirm this.
How was the vulnerability handled?
Collabora fixed the flaw on 9 September and released version 26.4.303 on 11 September. However, the advisory and CVE were only published on 14 October, leaving a gap of over four weeks. During this time, some administrators were aware of the risk thanks to community warnings, but the lack of a CVE made it harder to identify and defend against the issue. Collabora and Nextcloud said the delay was due to backlogs in GitHub’s CVE processing, which they attribute to a surge in AI-driven vulnerability reports. Nextcloud said it did not see widespread exploitation and wanted to give users time to update.
What should administrators do?
Admins should upgrade to version 26.4.303 or later as soon as possible. Removing the server app entirely is also an option if it is not needed. Simply disabling the app is not enough to protect against the flaw. Community warnings were issued as early as 3 October, urging immediate updates due to ongoing attacks.
The bigger picture: Delays in vulnerability disclosure
A study by Second Security found that the median time between a public fix and CVE publication was 39 days in August 2026, up from just over 5 days in January. This means attackers may have days or weeks to exploit flaws before defenders are fully informed. The researchers also noted that AI tools make it easier for attackers to create working exploits soon after a fix is published, increasing the risk during these gaps.
What is still unclear?
So far, only BleepingComputer has reported on these attacks. There is no official statement from the vendors or a government agency. The number of affected systems and the full impact are not yet known. Some claims of ransomware activity remain unconfirmed.
Claimed vs confirmed
- Unconfirmed
Ransomware operators are exploiting the flaw.
Some users reported ransomware activity, but BleepingComputer could not confirm this.
The impact
- Money
- If personal data was accessed, organisations in the UK or EU could face GDPR fines of up to £17.5m or 4% of global turnover. No direct financial losses or ransom demands have been confirmed.
- Reputation
- Organisations using the affected Nextcloud add-on may face trust issues if attackers accessed sensitive data. The delayed disclosure may also raise questions about vendor communication.
- Customers
- Users of affected Nextcloud servers could have their passwords or files stolen. Admins should update the software and check for signs of compromise.
Why it matters
This flaw puts servers running the affected Nextcloud add-on at risk of full compromise, including theft of passwords and sensitive files. Many organisations use Nextcloud for file sharing and collaboration. Delays in official warnings and CVE publication can leave systems exposed for weeks.
How does it work?
The vulnerability allows attackers to send a malicious request to the proxy.php endpoint of the built-in CODE server app for Nextcloud. If the server is stopped, the flaw lets them inject operating system commands without authentication or user interaction. This is known as a remote code execution (RCE) vulnerability.
Key points
- A critical RCE flaw in Collabora's CODE server for Nextcloud is being exploited.
- Attackers can install backdoors and search for sensitive files if the server is stopped.
- The flaw only affects the optional built-in CODE server app, not standalone or Docker installs.
- Admins should update to version 26.4.303 or later, or remove the app if not needed.
- Delays in CVE publication can leave systems exposed to attack.
Sources
BleepingComputer
Reference
