Nextcloud Collabora Flaw Under Attack: Update Now

If you run Nextcloud at home or for a small team and you ever clicked "install" on the Collabora Online built-in server app, stop what you're doing and check its version. A command injection bug in that app has been used to plant web shells on real servers since September, and on October 23 the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog. I first saw the KEV addition in a post from The Hacker News.

What happened

The flaw is CVE-2026-110447. It sits in richdocumentscode, the Nextcloud app called "Collabora Online - Built-in CODE Server" that bundles a document editor so you don't need a separate Collabora box. According to Collabora's security advisory, a crafted request to the app's proxy.php can make the server run an operating system command as the web server user. No login is needed.

There's one condition: the attack only works while the bundled CODE server isn't running. That sounds narrow until you remember how often it happens, because a container restart, an upgrade or a crash all leave that window open.

The fix shipped quietly in version 26.4.303 on September 11, but the advisory and CVE only appeared on October 14. In the gap, admins on the Nextcloud forum started finding strange PHP files inside the app folder, including one-line backdoors. BleepingComputer reports that admins traced attacks back to September 10 and saw the shells used to hunt for password databases, password manager files and crypto wallets.

CISA added an Arista VeloCloud Orchestrator SQL injection bug (CVE-2026-114625) to its catalog on the same day. Both carry an October 26 deadline for US federal agencies.

Why it matters

Nextcloud is one of the most popular self-hosted Google Drive replacements, and the built-in CODE app is the easy option most hobbyists pick. Those servers usually hold exactly what an attacker wants: documents, photo backups and synced password exports. Also, the advisory says plainly that disabling the app isn't enough. You have to update it or remove it.

The good news is that a lot of setups are safe. Standalone Collabora servers, Docker and Linux package installs, and Nextcloud All-in-One aren't affected.

What to do

• Check the app version. In Nextcloud, go to Apps and find "Collabora Online - Built-in CODE Server". Anything below 26.4.303 needs updating now.
• Remove it if you don't use it. Turning it off doesn't close the hole.
• On Nextcloud 29 or older? Those versions are end of life. Upgrade Nextcloud or uninstall the app.
• Hunt for leftovers. Run the integrity check (the admin overview shows it, or use occ integrity:check-app richdocumentscode) and look for unexpected PHP files under apps/richdocumentscode. Search your access logs from September 10 onward for requests to proxy.php.
• If you find a shell, treat the server as compromised. Rotate every password and key stored on it, not just the Nextcloud admin login.

I keep saying it about self-hosted gear, but it's worth repeating. If a box is on the internet, its apps need the same update habit as your phone. Even with my own Raspberry Pi VPN setup, I'd rather reach home services over a VPN than open them straight to the web.