Hackers are exploiting a critical flaw in an optional Collabora component used with Nextcloud, and some administrators say attackers planted backdoors on their servers. The issue, CVE-2026-110447, is an unauthenticated operating-system command injection bug in the Collabora Online - Built-in CODE Server app (richdocumentscode) before version 26.4.303, triggered via proxy.php when the built-in server is stopped. Collabora says standalone Collabora servers, Docker and RPM/DEB installs, and Nextcloud All-in-One are not affected.
Why it matters: Organizations using the built-in Collabora server for Nextcloud could be compromised without a login if they have not updated. Admins should upgrade to 26.4.303 or later immediately or remove the built-in server app, because simply disabling it is not enough.
Bill Toulas
2026.10.15
100% relevant
This article establishes the story by tying together the newly assigned CVE-2026-110447, vendor guidance, affected versions, and reports of in-the-wild exploitation against Nextcloud servers using the built-in Collabora CODE app.
← Back to all stories