Reports describe exploitation of Collabora flaw to backdoor Nextcloud servers

The bundled CODE Server must be stopped

BleepingComputer reported that threat actors are exploiting CVE-2026-110447, a command-injection flaw in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. The report says malicious requests to proxy.php can trigger operating-system command execution when the built-in CODE server is stopped, without authentication or user interaction. Administrator reports described PHP webshells—server-side scripts that can provide remote control—being planted and used to search for password databases, password-manager artifacts, and cryptocurrency wallets. The affected app versions are those before 26.4.303. Collabora said standalone Collabora Online servers, Docker and RPM/DEB installations, and Nextcloud All-in-One deployments are unaffected.

The available report does not establish a comparable baseline for the number of affected servers or the extent of exploitation.

The new reported finding is active exploitation of CVE-2026-110447 against the optional built-in CODE Server app in Nextcloud, with administrator reports describing webshell deployment after command injection.

The reported activity concerns an optional bundled component rather than all Nextcloud or Collabora deployments, and successful exploitation has a stated operational prerequisite: the built-in server must be stopped. The report recommends upgrading to 26.4.303 or later or removing the server app if it is not needed; it says merely disabling the app is insufficient.