Security · Updated 16 Oct, 01:55 am IST
Critical Collabora flaw used to backdoor Nextcloud via built‑in CODE app
Why it matters for readers: It matters because a single optional plugin allowed unauthenticated access that let attackers install web shells on servers.
- The vulnerability (CVE-2026-110447) allows unauthenticated OS command injection through the app’s proxy.php endpoint when the bundled CODE server is stopped.12
- Attackers used the flaw to install PHP web shells and search for password stores and crypto wallets on affected servers.12
- Collabora released a fix in version 26.4.303 on September 11 and published an advisory on October 14; administrators must update or remove the built‑in app.12
- Only the optional built‑in CODE app (richdocumentscode) is affected; standalone Collabora Online servers, Docker/RPM/DEB installs and Nextcloud All‑in‑One deployments are not impacted.12
Get a brief like this every morning
Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.
Get startedHow this story developed
14 Oct, 11:08 pm · The Hacker News
Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
16 Oct, 01:55 am · BleepingComputer
Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers