Nextcloud Servers Exploited via Collabora Built-in CODE Vulnerability
A critical vulnerability in the Collabora Online - Built-in CODE Server application for Nextcloud is being exploited to deploy webshells.
A security flaw, identified as CVE-2026-110447, allows for system command injection without authentication and has been actively exploited since September 10, 2026. The vulnerability affects Nextcloud instances using the Collabora Online - Built-in CODE Server application (richdocumentscode), which integrates Collabora Online Development Edition (CODE) directly into the Nextcloud server.
The flaw resides in the proxy.php script, which initiates a CODE server when one is not running. Versions prior to 26.4.303 improperly handled requests, allowing attackers to execute commands with the server web account privileges, particularly during server restarts or updates.
Attackers have already exploited the vulnerability to deploy webshells and search for sensitive data like password stores and cryptocurrency wallets. Users are advised to update to version 26.4.303 or higher, or remove the application entirely, and to examine server logs for suspicious activity.