KIungefiltert

· 4 min read · Auf Deutsch lesen

Collabora CODE Server in Nextcloud: Critical Flaw Under Attack, and Disabling the App Isn't Enough

CVE-2026-110447 (CVSS 9.2) in Nextcloud's built-in Collabora CODE Server is being exploited to plant web shells. A fix exists: 26.4.303 or later. Disabling the app does not protect you.

securityself-hosting

Translated from the German original with an AI language model, approved by me. Read the original

The US cybersecurity agency CISA has added a flaw in Nextcloud's built-in Collabora Online CODE Server to its KEV catalog. KEV stands for "Known Exploited Vulnerabilities", meaning flaws that attackers are already using in the wild. The bug is tracked as CVE-2026-110447. It scores 9.2 out of 10 on CVSS and allows remote code execution without any login.

What has changed since my post

When I posted this on X and the WhatsApp channel, the patch situation was still unclear. That is no longer the case. According to Collabora's GitHub advisory, the flaw is fixed in version 26.4.303 of the app. The advisory also adds something my post didn't cover: simply disabling the app does not protect you.

What exactly is broken

The affected component is the Nextcloud app "Collabora Online – Built-in CODE Server", technical name richdocumentscode. CODE is the developer edition of Collabora Online, a browser-based office suite. The built-in variant runs directly inside the Nextcloud server. That is convenient because you don't need a separate office server.

The flaw is an OS command injection. Input from a web request ends up unchecked in a command passed to the operating system. With a crafted request, an attacker can run their own commands with the web server user's privileges. Per the advisory, the bug sits in the app's proxy.php. It can only be exploited while the built-in CODE server is not running, for example after a container restart, an update or a crash. That sounds like a hurdle, but in practice it happens regularly.

According to Collabora, standalone Collabora Online servers and the separate "Nextcloud Office" connector app (richdocuments) are not affected. This is only about the built-in variant.

What attackers are doing with it

This isn't a theoretical risk. According to The Hacker News and an analysis by Corgea, attacks have been going on since at least early September 2026. The attackers planted web shells, small scripts that let them control the server remotely afterwards. They used them to read the Nextcloud configuration, which holds database and mail server credentials among other things. They also looked specifically for password manager files and cryptocurrency wallets. Corgea notes that Italy's CSIRT also published a bulletin about the theft of these configuration secrets.

CISA added the flaw to the catalog on October 23, 2026. US federal agencies had until October 26 to fix it. That deadline doesn't apply to anyone else, but it shows how seriously the agency takes the issue. None of the sources say how many systems are affected worldwide.

Who is affected

Anyone running Nextcloud with the "Built-in CODE Server" app below version 26.4.303 is affected. That typically means self-hosted instances at small businesses, nonprofits, schools and homes, which are exactly the setups where people skip a separate office server. Nextcloud 29 and older are a special case. They are end-of-life, and according to the advisory they can't install the fixed app.

What you should do now

  1. Check whether the app is installed, even if it's disabled. Disabled doesn't mean removed.
  2. Update to at least 26.4.303 or remove the app. Corgea describes two later releases with further hardening, 26.4.402 and 26.4.502. It recommends the newest one, because that is the first release where disabling the app actually closes the vulnerable entry point. My advice: go straight to the latest version.
  3. On Nextcloud 29 or older? Remove the app or upgrade Nextcloud to a supported version.
  4. Look for traces. Unexpected PHP files in the app's directory are a red flag. An update won't remove a web shell that's already there, and it won't make stolen data secret again.
  5. If you suspect a compromise, clean up properly. Preserve logs and suspicious files, rebuild the server or container from a clean image, and rotate every secret the web server could read. That includes database and mail passwords as well as the secrets in the Nextcloud configuration.

My take: the built-in office variant is a convenience option. If you rely on Nextcloud Office seriously, a standalone Collabora server is usually the better choice. If you don't use it at all, delete the app rather than just switching it off.

Sources