CISA adds Collabora Built-in CODE Server flaw CVE-2026-110447 to its exploited list after attackers planted web shells on Nextcloud servers

· CyberSecurity

TLDR

  • CISA added CVE-2026-110447, a command injection in Collabora's CODE Server app for Nextcloud, to its exploited list on 23 October.1
  • Administrators reported web shells on Nextcloud servers from 10 September; the fix, 26.4.303, shipped on 11 September.23
  • Disabling the app does not help; it must be updated to 26.4.303 or later, or removed.23

CISA added CVE-2026-110447, described as a Collabora Online Built-in CODE Server OS command injection vulnerability, to its Known Exploited Vulnerabilities catalogue on 23 October, citing evidence of active exploitation.1 The flaw is in the optional richdocumentscode app for Nextcloud, which downloads a copy of Collabora Online Development Edition and runs it on the Nextcloud server.3 Versions before 26.4.303 are affected.23

The Hacker News reports that the app's proxy.php script starts the local server when a request arrives and nothing is listening, and in versions up to 26.4.302 placed text from the request path inside a double-quoted bash command, so a command hidden in the path ran as the web server user.3 Because the command is only built when the server needs to start, the attack works only while the built-in server is down, for example after a restart, upgrade or crash, and needs no authentication or user interaction.23 Standalone Collabora Online servers, Docker and package installations and Nextcloud All-in-One deployments are not affected, according to Collabora as reported by BleepingComputer.2

Timing is unusual. Collabora committed the fix on 9 September and released 26.4.303 on 11 September, but the advisory and CVE were published only on 14 October, a gap of more than four weeks.23 BleepingComputer says administrators reported attacks dating back to 10 September, and that Collabora blamed GitHub CVE-processing backlogs under strain from AI-driven security reports, while Nextcloud said it gave users time to update and had not seen widespread exploitation.2 The Hacker News reports that three administrators described attackers dropping a one-line PHP web shell and then searching for password databases, password-manager files and cryptocurrency wallets, with no commands seen that copied files out and no root access shown.3 BleepingComputer adds that some users reported ransomware operators exploiting the flaw, which it could not independently confirm, and The Hacker News says the number of servers hit is not known.23

Collabora's advisory says disabling the app is not enough.3 The Hacker News advises updating richdocumentscode to 26.4.303 or later or removing it, upgrading Nextcloud or removing the app on Nextcloud 29 or older, and checking for leftover shx*.php files.3 The CISA alert names the flaw but gives no further technical detail.1

Why it matters: servers that ran the built-in CODE app before 26.4.303 may have been compromised since 10 September, so administrators should patch or remove the app and treat anything the web server account could read as potentially exposed.23

Sources

  1. CISA Adds One Known Exploited Vulnerability to Catalog (CISA)
  2. Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers (BleepingComputer)
  3. Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora's Built-in CODE App (The Hacker News)