Critical Collabora CODE flaw puts Nextcloud servers at risk
A command-injection flaw in Nextcloud’s built-in Collabora CODE app has been exploited in the wild; update or remove it.
Attackers have exploited a command-injection flaw in Collabora Online’s Built-in CODE Server app for Nextcloud, planting web shells on affected servers while the local document server was stopped. The issue is tracked as CVE-2026-110447, and Collabora says versions before 26.4.303 are affected. 1
Why the flaw works
The vulnerable app starts its local Collabora Online Development Edition server through a PHP script when a request arrives and nothing is listening. In versions up to 26.4.302, text from the request path was inserted into a shell command in a way that allowed command substitution. An unauthenticated request could therefore execute commands as the web server account when the local service was down, such as during a restart, upgrade or crash. 1
Administrators reported attacks beginning on 10 September, including web shells written into the app directory and attempts to search for credential stores and cryptocurrency wallets. The available reports do not show root access, but anything readable by the web server account should be treated as potentially exposed. 1
Update or remove the app
Collabora’s advisory says administrators must update the richdocumentscode app to version 26.4.303 or later, or remove it. Simply disabling the app is not enough. Nextcloud 29 and older cannot install the fixed version, so those installations need a Nextcloud upgrade or app removal. 1
Administrators should also check for shx*.php files, review access logs from at least 10 September for suspicious proxy.php requests and investigate unexpected sudo attempts by the web server account. 1
Our opinion
This is a particularly awkward vulnerability because the trigger is a maintenance state rather than normal document editing: the app becomes dangerous when its local service is absent. That makes “we disabled it” an unsafe conclusion. The practical response is refreshingly clear, though — patch to the fixed version or remove the built-in server, then investigate the host as potentially compromised rather than treating the update as the end of the incident.
Photo illustration: Sergei Starostin on Pexels. 2