24 OCT 2026 — The US Cybersecurity and Infrastructure Security Agency (CISA) on 23 October added a critical flaw in a Nextcloud add-on made by Collabora to its catalogue of vulnerabilities known to be exploited, giving federal civilian agencies until 26 October to fix it. The bug, CVE-2026-110447, sits in the Collabora Online – Built-in CODE Server app, which lets a Nextcloud server run an online office suite on the same machine as its files. Administrators were finding web shells planted through it in September, more than a month before the CVE was published.
What CISA added and when
The catalogue entry describes an OS command injection that "allows for remote code execution when the CODE server isn't running". CISA records ransomware use as unknown and flags the entry for forensic triage. Under Binding Operational Directive 26-04, that flag means an agency must fix or mitigate the bug within three days and then examine the machine to find out whether it was already compromised, according to the directive.
The directive binds US federal civilian agencies only. For everyone else, the catalogue is a list of bugs that attackers are using in practice.
How the attack works
Collabora's security advisory, published on 14 October, says a request to the app's proxy.php file "can cause an operating system command to run as the web server user". No login is needed. The catch for attackers is timing: the injection works only while the built-in server is down, which happens on a container restart, during an upgrade or after a crash.
For administrators, two details matter. Switching the app off does not help. "It is not sufficient to disable the app to avoid the problem," the advisory says. The only safe options are version 26.4.303 or later, or taking the app out. Standalone Collabora Online servers are not affected. The NVD record says the flaw was "exploited in the wild in September and October 2026" and is separate from CVE-2025-66208, an earlier bug whose fix does not block this one.
Web shells before a CVE existed
The first public report came from an operator running several Nextcloud servers. It opened an issue on Collabora's GitHub repository on 11 September, saying its systems had been hacked through the app since the day before. The earliest request quoted in the report is timestamped 10 September. Each request hid base64-encoded shell commands in the URL, wrote a small PHP file into the app's folder and then checked whether that file would run commands.
On one server, the reporter said, the attacker used the shell to search for password manager databases and cryptocurrency wallet files. The logs showed no command that copied files out. Other administrators in the thread described the same pattern on their own machines.
A community member posted a warning on Nextcloud's help forum on 3 October, noting that no CVE had yet been published. Later in that thread, one administrator wrote that Nextcloud's integrity check had flagged an extra PHP file in the app's folder holding a one-line backdoor.
A fix that shipped quietly
The patch is five weeks older than the CVE. The repository's change history shows the edit to proxy.php committed on 9 September under the message "tidy up how the coolwsd launch command is built", with no mention of security. The version bump to 26.4.303 followed on 11 September. The advisory and CVE came on 14 October.
In a blog post on 15 October, Collabora said the app is aimed at home users and used by a minority of Nextcloud users, and that "No Collabora Online customers were affected". It put most of the delay down to a slower CVE process. "The time required to get a GitHub CVE filed and published has gone from around a day to many weeks this year," the company wrote, citing a very high volume of AI-driven security reports landing on software vendors. It is applying to become a CVE Numbering Authority so it can assign identifiers itself.
Nextcloud gave a different reason. It told BleepingComputer that holding back the disclosure let users update first, and that it had seen no widespread exploitation, according to the outlet's report. Collabora, Nextcloud and CISA have not published the number of compromised servers.
What administrators should check
Look in Nextcloud's app list for Collabora Online – Built-in CODE Server (richdocumentscode). If it is there, upgrade it to 26.4.303 or later, or remove it. Collabora says installations using its Docker images, RPM or DEB packages, or Nextcloud All-in-One are not affected. The advisory tells anyone on Nextcloud 29 or earlier, an end-of-life release, to upgrade Nextcloud or remove the app.
Patching does not undo a compromise. Anyone who ran a vulnerable version should look for unexpected PHP files in the app's folder, run Nextcloud's integrity check and search web server logs for requests to proxy.php going back to early September. A shell running as the web server user can read whatever that account can, so database passwords and other secrets it holds should be treated as exposed and changed. For a new installation, our guide to self-hosting Nextcloud with Docker uses the All-in-One deployment, which Collabora lists as unaffected.
View author profile → · Editorial policy
