Attackers Used a Critical Flaw in Collabora’s Built-in CODE App to Plant Web Shells on Nextcloud Servers

Collabora has disclosed a critical flaw in an optional Nextcloud app, Collabora Online – Built-in CODE Server, that attackers have already used to plant web shells on servers. The flaw is tracked as CVE-2026-110447 and rated 9.2 out of 10 (Critical) in Collabora’s advisory, published on GitHub on 14 October 2026.

A web shell is a small file that lets an attacker run commands on a server through ordinary web requests.

What the flaw does

“A request can cause an operating system command to run as the web server user,” Collabora’s advisory says. The attack only works at certain times: “The attack only works while the built-in CODE server is not running. So on a container restart, an upgrade, or after a crash.”

The fix is version 26.4.303 of the app. Turning the app off is not enough. “It is not sufficient to disable the app to avoid the problem, it must be upgraded to >= 26.4.303 or removed,” the advisory says. Users of old Nextcloud versions 29 and below “should upgrade their Nextcloud or remove this app.” Standalone Collabora Online servers are not affected.

Exploited in the wild

According to The Hacker News, the CVE record describes the flaw as “exploited in the wild in September and October 2026.” The Hacker News reports that three administrators reported web shells on their servers on GitHub, with the first logged attack on 10 September. On one server, it says, the attacker then searched for credential stores and cryptocurrency wallets. None of the reports show the attacker gaining full (root) control.

It is not known how many servers were hit.

The Hacker News reports that version 26.4.303 was released on 11 September, but its release notes did not mention a security fix. On 3 October, a user on the Nextcloud community forum warned others to update because the flaw was “already being exploited” and “no warning or CVE has been published.” The advisory followed on 14 October.

What to do

• Update the Built-in CODE Server app to 26.4.303 or later, or remove it. Disabling it does not help.
• On Nextcloud 29 or older, upgrade Nextcloud or remove the app. The Hacker News reports that the fixed versions need Nextcloud 30 or later.
• Check for leftover web shell files and review server logs back to at least 10 September, as The Hacker News advises.

What this means

• Self-hosted servers were hit. Attackers have been using this flaw since September.
• The fix came before the warning. The patch shipped in September; the security notice came a month later.
• Turning it off is not enough. Admins must update or remove the app.

Sources

1. Collabora Online, GitHub security advisory GHSA-g3vx-3m76-fghh (CVE-2026-110447), 14 October 2026. https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh
2. The Hacker News, “Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App”, 14 October 2026. https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html
3. Nextcloud community forum, “To Collabora Built-in User: Update ASAP”, 3 October 2026. https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516

Related stories

• Cisco Patches a Secure Email Gateway Zero-Day That Attackers Are Already Using
• Attackers Are Exploiting an Ivanti Connect Secure Zero-Day, and CISA Gives US Agencies Until 16 October to Act
• AhsayCBS Backup-Server Flaws Exploited to Plant Webshells and Cryptominers, Huntress Reports