What the Collabora CODE flaw means for Nextcloud

Attackers are exploiting CVE-2026-110447, a critical command execution flaw in the Collabora Online - Built-in CODE Server app for Nextcloud, according to BleepingComputer. The fix shipped on September 11. The advisory and CVE ID did not appear until October 14, and administrators report attacks going back to September 10. That gap is what matters most. If you rely on CVE feeds to tell you what to patch, this flaw reached your feed about a month after it reached attackers.

The background you need

Nextcloud is self-hosted file sync and collaboration software. Think of it as a Dropbox or Google Drive that you run on your own server. Companies, schools, and home labs use it to keep files on hardware they control.

Collabora Online is a browser-based office suite built on LibreOffice. It lets Nextcloud users open and edit documents, spreadsheets, and presentations without downloading them. CODE stands for Collabora Online Development Edition, the free edition of that suite.

You can connect Collabora to Nextcloud in two broad ways. The first is to run Collabora as its own service: a separate server, a Docker container, or a package installed from your Linux distribution. The second is the shortcut. You install an app from the Nextcloud app store called Collabora Online - Built-in CODE Server, whose internal name is richdocumentscode. It bundles a Collabora server inside the Nextcloud app and starts it for you. This saves setup work, so it is popular on small installs. That shortcut is where the bug lives.

A few more terms:

• Command injection: a bug where text from an outside request ends up inside a command the server runs on its operating system. If an attacker can shape that text, they can tack on their own commands.
• RCE (remote code execution): the result. Someone on the network can make your server run code of their choosing.
• Webshell: a small script, here written in PHP, that an attacker drops into your web directory. After that, they can come back and run commands through ordinary web requests, even if the original hole is later closed.
• CVE: a public ID number for a vulnerability. Security scanners, patch dashboards, and vulnerability feeds mostly track issues by CVE. If a flaw has no CVE, many tools simply do not know it exists.
• Advisory: the vendor's formal write-up of a flaw, usually including affected versions and fixes. Projects hosted on GitHub often publish these as GitHub security advisories. GitHub can also issue the CVE ID.

A rough analogy: a CVE is like a car recall notice. In this case, the manufacturer swapped the faulty part at the service center weeks before mailing any recall letters. Owners who brought their car in got the fix. Everyone else had no reason to go. The analogy breaks in one important way. Car thieves cannot read the service center's work orders. Attackers can read a public code fix, work out what it repairs, and build an exploit from it.

What actually changed

Very little changed in the software on October 14. What changed is that the problem became officially visible. Here is the timeline as BleepingComputer reports it:

• September 9: the fix was committed to the code.
• September 10: affected administrators say attacks against their systems date back to this day.
• September 11: richdocumentscode version 26.4.303 was released with the fix.
• Mid-September: maintainers warned about the issue, and attacks began, according to multiple admin reports.
• October 3: a community warning urged administrators to update immediately because of ongoing exploitation.
• October 14: the security bulletin, GitHub advisory, and CVE were published.

BleepingComputer describes how the attack works. An attacker sends a malicious request to the app's proxy.php endpoint, which triggers OS command injection. The attacker needs no account and no user interaction. There is one prerequisite: the built-in CODE server must be in a stopped state, for example after a restart, an upgrade, or a crash.

According to the admin reports, once inside, the attacker planted PHP webshells. They used them to search for password databases, password manager artifacts, and cryptocurrency wallets. Some users also reported that ransomware operators are exploiting the flaw. BleepingComputer says it could not independently confirm that.

The scope is narrow, according to Collabora. Only the optional built-in CODE server app is affected. Standalone Collabora Online servers, Docker and RPM/DEB installations, and Nextcloud All-in-One deployments are not affected.

What it means for developers and IT staff

The delayed CVE decides how you should respond. For about a month, a vulnerability scanner keyed to CVE IDs would have shown nothing for this flaw, even while attacks were happening. So a clean scan report from September tells you nothing. Work from the facts instead:

1. Find out whether you run the app. In your Nextcloud apps list, look for Collabora Online - Built-in CODE Server (richdocumentscode). If you connect to a separate Collabora server, Docker container, or package install, or you use Nextcloud All-in-One, Collabora says you are not affected.
2. Check the version. Anything before 26.4.303 is vulnerable.
3. Upgrade or remove. BleepingComputer reports the recommendation is to upgrade to 26.4.303 or later, or to remove the app if you do not need it. The vendor warned that disabling the app is insufficient. Do not stop at clicking disable.
4. Assume you may already be compromised. If an old version was installed at any point since early September, upgrading only closes the door. A webshell planted earlier would still work. Look for PHP files in your Nextcloud directories that you did not put there. Review web server logs for unusual requests to proxy.php. Since the attackers reportedly hunted for password stores and wallets, consider which secrets were reachable from that server and whether to rotate them.

This matters beyond Collabora. BleepingComputer cites a study by security firm Second Security of real-world open-source flaws. It found the median gap between a public fix and CVE publication was 39 days in August, up from 5.1 days in January. The researchers also found that public exploit code often appeared within hours of a fix, days before the matching CVE. If that pattern holds, CVE feeds alone will keep leaving you behind. For self-hosted software that faces the internet, it is worth following the project's own release notes and security channels, and applying security updates when they ship rather than when a CVE appears.

Disabling the built-in CODE server app does not protect you, according to the vendor. Upgrade richdocumentscode to 26.4.303 or later, or remove the app entirely. Then check the server for webshells, because a fix does not remove anything an attacker already planted.

What we don't know yet

• How many servers were hit. BleepingComputer asked Nextcloud for the number of impacted systems. The reported response does not include one.
• Who is behind the attacks. No source names an attacker. The ransomware reports remain unconfirmed.
• Why disclosure took so long. The sources give different explanations. Nextcloud told BleepingComputer the delay gave users time to update and that it had not observed widespread exploitation. That sits uneasily with admin reports of attacks across multiple endpoints since September 10. Collabora, in a blog post, attributed the delay mainly to GitHub CVE-processing backlogs, which it said were strained by rising volumes of AI-driven security reports. Second Security's researchers suggest AI-assisted discovery is straining CVE processing in general. That is their suggestion about a trend, not a confirmed cause in this case.
• How attackers met the stopped-server condition. The sources say the built-in server must be stopped, and they give restarts, upgrades, and crashes as examples. They do not say whether attackers waited for that state or found a way to cause it.
• Why disabling is not enough. The vendor's warning is reported, but the technical reason is not explained.

---

Originally published at pickuma.com. Subscribe to the RSS or follow @pickuma.bsky.social for new reviews.