Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers

CVE-2026-110447 is a critical vulnerability in richdocumentscode, the Nextcloud app that launches a bundled Collabora Online CODE server. It matters because an attacker can reach command execution on the underlying Nextcloud server without needing a login or user action. Only versions before 26.4.303 are affected.

The attack uses a malicious request sent to the app’s proxy.php endpoint. That request triggers OS command injection through the app’s mechanism for starting the bundled Collabora server. A successful attack requires the built-in CODE server to be stopped, such as after a restart, upgrade, or crash.

Administrators should upgrade to version 26.4.303 or later, or remove the app if it is unnecessary. Simply disabling the app is not enough protection, according to the vendor. The flaw has already been exploited, with reports describing PHP webshells and searches for sensitive credentials and cryptocurrency wallets.

The vulnerability is limited to Nextcloud installations using the optional built-in CODE Server app, known as richdocumentscode. This distinction matters because many Collabora deployments do not use that app or its vulnerable server-starting mechanism.

Collabora said standalone Collabora Online servers are unaffected. The same applies to Docker installations, RPM and DEB installations, and Nextcloud All-in-One deployments. The affected component is specifically the bundled CODE server inside the Nextcloud app.

Administrators must identify how Collabora is deployed before judging exposure. A server using the vulnerable built-in app should be upgraded to version 26.4.303 or later, or the app should be removed if it is not needed. The article says that merely disabling the app is insufficient, so administrators should follow the vendor’s recommended remediation rather than rely on a disabled state.

The attacks were not a brief, isolated event. Multiple administrators reported malicious activity against several endpoints dating back to September 10, and maintainers warned about exploitation in mid-September. A community warning followed on October 3. The article does not provide a total number of compromised systems, and Nextcloud said it had not observed widespread exploitation.

The patch was committed on September 9, and version 26.4.303 was released on September 11. The formal advisory and CVE publication came on October 14. That is 35 days after the commit, or 33 days after the release, showing that exploitation began while public vulnerability labeling lagged behind the fix.

The delay made it harder for administrators to identify the issue and apply focused defenses. Second Security found that the median gap between public fixes and CVE publication reached 39 days in August, compared with 5.1 days in January. The article links longer delays to growing AI-assisted vulnerability discovery volumes.

Planting a PHP webshell turns a one-time vulnerability into an ongoing foothold. The attacker places a PHP file on the server, then uses it to interact with the compromised system through web requests. This can allow continued command execution after the original malicious request has ended.

Administrators reported that attackers used the webshells to search for password databases, password manager artifacts, and cryptocurrency wallets. These targets could expose credentials, stored secrets, or digital assets. Some users also reported ransomware activity, although BleepingComputer could not independently confirm those claims.

The reported behavior shows why command execution is especially serious on an internet-facing application server. The initial flaw provides access, while the webshell can support further discovery and theft. Administrators should upgrade to version 26.4.303 or later, or remove the built-in server app if it is unnecessary.

The built-in CODE server must be stopped for the exploit to work. The article identifies common situations that can create this condition, including a restart, an upgrade, or a crash. The vulnerable behavior is tied to the app’s mechanism for starting the bundled Collabora server.

An attacker sends a malicious request to proxy.php while that server is stopped. The request reaches the starting mechanism and triggers OS command injection. No authentication or user interaction is required, but the stopped-server condition remains a key prerequisite for successful exploitation.

Administrators should not treat a disabled app as a complete fix. The vendor warned that disabling it is insufficient. The recommended actions are upgrading richdocumentscode to version 26.4.303 or later, or removing the server app when it is not needed. Standalone Collabora deployments and listed unaffected installation types do not require this specific remediation.

The direct protection is to upgrade the built-in server app to version 26.4.303 or later. Administrators who do not need the optional built-in CODE server should remove the app instead. The vendor specifically warned that simply disabling it is not enough.

Updating can be difficult when a fix appears before a formal CVE. Administrators often use vulnerability identifiers to match advisories, scanner results, inventories, and remediation guidance. In this case, the fix was committed September 9 and released September 11, but the advisory and CVE were not published until October 14.

That gap left defenders with less precise information while attacks were already being reported. Second Security found a 39-day median delay between public fixes and CVE publication in August, up from 5.1 days in January. The article says AI-assisted discovery and exploit creation may further increase the pressure on CVE processing.

A software bug becomes a practical attack when untrusted input reaches a command-running function. Here, a malicious proxy.php request triggers OS command injection in the mechanism that starts the bundled CODE server. The attacker does not need authentication or user interaction.

The attacker can then plant a PHP webshell. That file provides a convenient way to send further commands through the compromised server, including searches for password databases, password-manager artifacts, and cryptocurrency wallets. The webshell therefore extends the impact beyond the original request.

The article adds that AI tools make it easier to generate working exploits from published security fixes. Second Security found public exploit code often appeared within hours of a fix and before the CVE. This creates a dangerous race: defenders may have a patch, but attackers can exploit the change before formal vulnerability details reach administrators.