Collabora RCE Flaw Exploited to Backdoor Nextcloud Servers

Attackers are exploiting a Collabora RCE flaw to compromise Nextcloud installations running the optional Built-in CODE Server app. Administrator reports describe PHP webshells and searches for password databases, password manager files and cryptocurrency wallets.

The vulnerability, tracked as CVE-2026-110447, affects app versions earlier than 26.4.303. Reports place malicious activity as early as September 10, more than a month before the formal advisory and CVE publication.

However, the issue does not affect every deployment using Collabora or Nextcloud. Its scope is limited to the optional built-in server app, also known as richdocumentscode.

Vulnerability Affects the Built-In Server Startup Process

The Collabora RCE flaw resides in the mechanism that starts the bundled document server.

Attackers can send a crafted request to the app’s proxy.php endpoint to trigger operating-system command injection. Successful exploitation requires the built-in CODE server to be stopped, which can happen after a restart, upgrade or crash.

Neither authentication nor user interaction is necessary.

According to Collabora, standalone Collabora Online servers remain unaffected. Docker deployments, RPM and DEB installations, and Nextcloud All-in-One deployments are also outside the affected scope.

Consequently, administrators need to establish whether their installation uses the vulnerable built-in app rather than assuming all Collabora integrations share the problem.

Administrators Report Webshells and Searches for Sensitive Files

Affected administrators described attacks against multiple endpoints, with reports dating back to September 10.

The attackers reportedly planted PHP webshells, providing a way to issue further commands through the compromised web server. They then used that access to search for sensitive information, including password-related files and cryptocurrency wallets.

Some community reports also alleged ransomware activity. However, those claims remain independently unconfirmed.

Nextcloud said it had not observed widespread exploitation. Nevertheless, the administrator reports indicate that attackers were actively abusing the vulnerability before its formal disclosure.

Updating or Removing the App Addresses the Vulnerability

Administrators should upgrade the Built-in CODE Server app to version 26.4.303 or later. Alternatively, they can remove the app if they no longer need it.

Crucially, Collabora warned that merely disabling the app is insufficient.

The fix entered the codebase on September 9, and the corrected release followed on September 11. A community warning on October 3 subsequently urged users to update because exploitation was ongoing.

However, the advisory and CVE did not appear until October 14, leaving more than four weeks between the patched release and formal publication.

Disclosure Delay Raises Questions About Vulnerability Tracking

Nextcloud said Collabora reported the vulnerability in mid-September and made an update available through the app store. It described the disclosure delay as giving users time to install the fix.

Meanwhile, Collabora primarily attributed the delayed announcement to GitHub CVE-processing backlogs. The company said increasing volumes of AI-assisted security reports were placing pressure on that process.

Separate research from Second Security examined similar delays across open-source vulnerabilities. Its analysis found that the median interval between public fixes and CVE publication reached 39 days in August, compared with 5.1 days in January.

The researchers also found cases where public exploit code appeared within hours of a fix, before a corresponding CVE became available.

For this incident, the timeline highlights a practical concern: attackers were exploiting the affected app while administrators still lacked a formal vulnerability identifier.