A flaw in Nextcloud’s Collabora Online - Built-in CODE Server add-on (richdocumentscode) allowed remote commands with the web server user’s permissions and was exploited to plant web shells.
Exploitation was possible only while the local document server was inactive, such as during a restart.
Collabora released version 26.4.303 on 11 September 2026; disabling the add-on alone does not fix the issue.
How did the attack work?
The problem occurs when the document server is not active, such as during a reboot. The attackers took advantage of this time window to "plant" small malicious files on the server. Through these, they could control the server with the rights of the user managing the software.
According to the data, the attackers were looking for files containing passwords, digital wallets and other sensitive data. While there is no indication that the perpetrators were able to gain full control as administrators of the system, any files that were accessible by the software may have been stolen.
Who is affected?
The vulnerability only affects those using the built-in version (Built-in CODE Server) of the add-on within Nextcloud. If you are using an external Collabora Online server, the issue does not affect you.
READ ALSO
Serious security flaw in curl allows servers to gain control of devices
What you have to do
Collabora released patch version 26.4.303 on September 11, 2026. To secure your system, follow these instructions:
- Update or uninstall: Simply disabling the add-on does not solve the problem. You must either upgrade to version 26.4.303, or uninstall the add-on completely if you do not need it.
- Older versions: If you are using Nextcloud 29 or an older version that does not support updating, the only safe option is to permanently delete the add-on or upgrade the Nextcloud platform to a newer version.
- Check for traces: Administrators should check their servers for suspicious files, paying particular attention to file names that start with "shx" and end with ".php."
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)