Nextcloud's built-in Collabora Office app used to plant backdoors on servers (CVE-2026-110447)

25 October 2026Critical 9.2Being exploited

Collabora · Collabora Online Built-in CODE Server (Nextcloud app) · CVE-2026-110447

Nextcloud's built-in Collabora Office app used to plant backdoors on servers

An OS command injection in the proxy of the Built-in CODE Server app (richdocumentscode) lets an unauthenticated attacker run commands as the web server user, while the built-in office server is not running (for example after a restart or upgrade). It was exploited in September and October, and Nextcloud users reported finding web shells. Standalone Collabora Online servers are not affected.

Affected: The Nextcloud app Collabora Online Built-in CODE Server (richdocumentscode) before 26.4.303, including on end-of-life Nextcloud 29 and earlier. Installs using a separate Collabora server, Docker or distro packages, or a Collabora hosting provider are not affected.
What to do: Upgrade richdocumentscode to 26.4.303 or later, or remove it if you do not use it (disabling it is not enough). Run Nextcloud's integrity check, look for unexpected PHP files, and rotate passwords the web server could read, such as database credentials.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
Why it’s here: Exploited; on CISA's KEV list; Nextcloud is a popular self-hosted file-sharing choice for small firms.

Nextcloud's built-in Collabora Office app used to plant backdoors on servers

Affected

The Nextcloud app Collabora Online Built-in CODE Server (richdocumentscode) before 26.4.303, including on end-of-life Nextcloud 29 and earlier. Installs using a separate Collabora server, Docker or distro packages, or a Collabora hosting provider are not affected.

What to do

Upgrade richdocumentscode to 26.4.303 or later, or remove it if you do not use it (disabling it is not enough). Run Nextcloud's integrity check, look for unexpected PHP files, and rotate passwords the web server could read, such as database credentials.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

Why it’s here

Exploited; on CISA's KEV list; Nextcloud is a popular self-hosted file-sharing choice for small firms.