// AI threat desk · 15 Oct 2026
Home/CVE · Vulns & Patches
Vulns & PatchesMediumCVECVSS not assigned

Collabora built-in CODE Server flaw exploited to plant web shells

Attackers exploited an optional Collabora app in Nextcloud to plant web shells, The Hacker News reported; it said Collabora fixed the flaw in version 26.4.303 on Sep 11, 2026.

· 2 min read
AI-generated image of security analysts examining suspicious activity on cloud server monitors.
AI-generated image, not a photo of the event.
Key takeaways
  • The Hacker News said attackers exploited an optional Collabora app to plant web shells on Nextcloud servers.
  • The Hacker News said an unauthenticated request could run a command when the local document server was not running.
  • The Hacker News said Collabora fixed the flaw in version 26.4.303 on Sep 11, 2026.

The issue affects the Collabora Online - Built-in CODE Server app used with Nextcloud, rather than standalone Collabora Online servers. Collabora identified the flaw as CVE-2026-110447 in an advisory published on Oct 14, 2026.

On this page

The attack used proxy.php while CODE Server was stopped

Collabora said users of Nextcloud with the built-in CODE Server app could be vulnerable through proxy.php. The attack worked only while the built-in CODE Server was not running, including after a container restart, an upgrade or a crash.

The Hacker News said access logs from two of the three administrators show requests at 19:51 on Sep 10 and 09:56 on Sep 11 (UTC+2), both from one IP address and both aimed at proxy.php?status with a shell command hidden in the request path.

The Hacker News said the command decoded a one-line PHP web shell into the app’s folder and tried to send the server’s uname -a output to a webhook.site address. It said reviewed requests showed no commands that archived, uploaded or copied out files, but files readable by the web server account had to be treated as potentially exposed.

Three administrators reported the issue on GitHub

The Hacker News said three administrators reported the issue on GitHub, with the first logged attack on Sep 10.

The Hacker News said none of the reports showed the attacker gaining root access.

Collabora said the flaw is fixed in richdocumentscode release 26.4.303. Users of end-of-life Nextcloud 29 or older should upgrade Nextcloud or remove the app.

“This is not the same path as CVE-2025-66208, and the fix for that issue does not prevent it,” Collabora said.

What to do now

  1. Upgrade the app to >= 26.4.303 or remove it.
  2. Upgrade your Nextcloud or remove this app if using EOL Nextcloud <= 29.
  3. Avoid using a reverse proxy that insecurely trusts X-Forwarded-Host.

FAQ

What happened in the Collabora CODE Server flaw?

The Hacker News said attackers exploited an optional Collabora app in Nextcloud to plant web shells on Nextcloud servers. It said the flaw allowed an unauthenticated request to run a command when the local document server was not running.

Which Nextcloud systems are affected by CVE-2026-110447?

The flaw affects Nextcloud installations using the Collabora Online - Built-in CODE Server app through proxy.php. Standalone Collabora Online servers are not affected.

Was the Collabora CODE Server flaw exploited?

The Hacker News said the first logged attack occurred on Sep 10, 2026, and that three administrators reported the issue. It said none of the reports showed the attacker gaining root access.

How do I fix the Collabora CODE Server flaw?

Upgrade the app to at least version 26.4.303 or remove it. Disabling the app alone does not resolve the problem.

Does the earlier CVE issue prevent this Collabora flaw?

No. Collabora said, “This is not the same path as CVE-2025-66208, and the fix for that issue does not prevent it.”

Sources

  1. Unauthenticated OS command injection in the richdocumentscode proxy, GitHubPrimary
  2. CVE-2025-66208 Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy, GitHubPrimary
  3. Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App, The Hacker News
How we checked this story
ClaimSourceStatus
The Hacker News said attackers exploited a flaw in an optional Nextcloud app to plant web shells on Nextcloud servers.The Hacker NewsAttributed
The Hacker News said the first logged attack occurred on September 10, 2026.The Hacker NewsAttributed
The Hacker News said the flaw allows an unauthenticated request to run a command as the web server user when the local document server is not running.The Hacker NewsAttributed
The Hacker News said the first reporter’s servers were attacked on September 10 and September 11 using a shell command hidden in the request path.The Hacker NewsAttributed
The Hacker News said the reviewed requests showed no commands that archived, uploaded, or copied out files.The Hacker NewsAttributed
The Hacker News said two other administrators reported the same issue on their own Nextcloud instances.The Hacker NewsAttributed
The Hacker News said none of the reports showed the attacker gaining root access.The Hacker NewsAttributed
The Hacker News said collabora fixed the flaw in version 26.4.303 on September 11, 2026.The Hacker NewsAttributed
The flaw affects the built-in CODE Server app through proxy.php.Collabora, via GitHubConfirmed
The attack works only while the built-in CODE Server is not running, including after a restart, upgrade, or crash.Collabora, via GitHubConfirmed
Standalone Collabora Online servers are not affected by the flaw.Collabora, via GitHubConfirmed
The flaw was fixed in richdocumentscode release 26.4.303.Collabora, via GitHubConfirmed
The earlier CVE-2025-66208 issue is a different path, and its fix does not prevent this flaw.Collabora, via GitHubConfirmed

Could not verify

  • How many Nextcloud servers were compromised is not established
  • Whether files or credentials were exfiltrated is not established
  • Whether the flaw received a CVSS score is not established
  • How the attackers obtained knowledge of the flaw is not established
cve
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok