Collabora CODE flaw exploited to backdoor Nextcloud servers

Collabora CODE flaw exploited to backdoor Nextcloud servers

Attackers have been abusing a critical command execution vulnerability in a Collabora app for Nextcloud for about a month. The flaw only received a CVE identifier this week.

The bug is tracked as CVE-2026-110447. It affects the Collabora Online - Built-in CODE Server app, known internally as richdocumentscode. Nextcloud administrators use this optional app to run a bundled Collabora document server directly inside their Nextcloud instance, so they don't have to deploy a separate one.

According to reports from several administrators, exploitation started in mid-September. That was roughly four weeks before the security bulletin, the GitHub advisory and the CVE entry were published.

How the attack works

The vulnerability exists in all richdocumentscode versions before 26.4.303. It sits in the code the Nextcloud app uses to start the bundled Collabora server.

Attackers send a crafted request to the app's proxy.php endpoint, which results in OS command injection. No authentication or user interaction is needed. There is one condition: the built-in CODE server has to be in a stopped state when the request arrives. That can happen after a restart, an upgrade or a crash.

Collabora says the problem is limited to the optional built-in CODE server app. Standalone Collabora Online servers are not affected. Neither are Docker installations, RPM/DEB package installations or Nextcloud All-in-One deployments.

Webshells, password hunting and wallet theft

Administrators who found malicious activity on their systems reported attacks against several endpoints, with the earliest dating to September 10.

The intruders reportedly dropped PHP webshells on the compromised servers. This is similar to the approach seen in recent attempts to plant backdoors on WordPress sites. The attackers then used the webshells to look for password databases, password manager artifacts and cryptocurrency wallets.

Some users also claimed that ransomware operators are using the flaw. BleepingComputer, which first reported on the attacks, was unable to independently verify this.

Patch, or remove the app

Administrators should upgrade richdocumentscode to version 26.4.303 or later. If the built-in server isn't needed, they can remove the app entirely. Collabora warns that simply disabling it is not enough to stay protected.

The timeline shows how long administrators were left without a clear reference point:

  • September 9: the fix was committed
  • September 10: earliest reported attacks
  • September 11: version 26.4.303 was released
  • October 3: a community warning urged administrators to update immediately because of ongoing exploitation
  • October 14: the advisory and CVE were published

The maintainers did issue warnings in mid-September. However, without a CVE ID it was harder for administrators to identify the issue, match it against their asset inventories and put the right defenses in place.

Vendors point to CVE backlogs

Nextcloud told BleepingComputer that Collabora reported the vulnerability in mid-September and that the update was pushed out through the app store. The company said it held back the disclosure to give users time to update, and that it had not seen widespread exploitation.

In a blog post about the attacks, Collabora gave a different main reason for the delay. It blamed a backlog in GitHub's CVE processing, which it said was under strain from a growing number of AI-driven security reports.

That view matches recent research from Second Security. The company examined real-world cases involving open-source vulnerabilities and measured the time between a public fix and the publication of a CVE. The median gap was 5.1 days in January and had grown to 39 days by August.

The researchers think the growing volume of AI-assisted vulnerability discoveries is overloading CVE processing and causing the delays. They also found that in many cases public exploit code showed up within hours of a fix, several days before the matching CVE appeared. According to Second Security, AI tools make it easy for attackers to turn published fixes into working exploits.

The Bigger Picture

The Collabora case is a good example of a problem that is likely to grow. Many organizations rely on CVE identifiers to decide what to patch and when. Vulnerability scanners, ticketing workflows and compliance checks often only react once a CVE exists. If fixes ship weeks before the identifier, the teams that depend on those processes are the last to find out, while attackers can study the public commit right away.

This suggests that administrators of self-hosted tools such as Nextcloud should not treat the CVE feed as their only early warning system. Vendor changelogs, app store updates and community forums deserve attention too, especially for internet-facing collaboration software that stores sensitive files.

The same AI tools that are speeding up bug discovery appear to be adding pressure to the disclosure pipeline itself. It is worth watching whether GitHub and other CVE numbering authorities change their processes to handle the load. It also remains to be seen whether the unconfirmed reports of ransomware activity linked to this flaw turn out to be accurate.