Attackers exploit critical Collabora Online command injection flaw to backdoor self-hosted Nextcloud servers

Administrators reported active exploitation of CVE-2026-110447, a critical OS command injection flaw in the Collabora Online built-in CODE Server app, richdocumentscode, for Nextcloud. The flaw is in the mechanism that starts the bundled Collabora server, reached through the app's proxy.php endpoint, and requires no authentication or user interaction when the built-in CODE server is stopped after a restart, upgrade, or crash. Attackers planted PHP webshells and searched for password databases, password manager artifacts, and cryptocurrency wallets, with some reports of ransomware. Versions before 26.4.303 are affected, and disabling the app is insufficient. Attacks date back to September 10, and the fix released September 11.

Check

Update the Collabora Online built-in CODE Server app, richdocumentscode, to 26.4.303 or later on Nextcloud, or remove it if unused, then hunt for PHP webshells.

Affected

Nextcloud servers running richdocumentscode before 26.4.303 let an unauthenticated attacker inject OS commands through proxy.php when the built-in CODE server is stopped, enabling webshells and data theft.

Fix

Upgrade richdocumentscode, remove it if not needed since disabling is insufficient, scan for webshells, rotate exposed credentials and wallets, and restore from clean backups where compromised.