Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
Summary: Attackers exploited a command-injection flaw in Collabora's optional Built-in CODE Server app for Nextcloud to plant PHP web shells, with the first logged attack on September 10 and three administrators reporting the issue on GitHub. The flaw, CVE-2026-110447, let an unauthenticated request run a command through proxy.php when the local CODE server was down, and Collabora fixed it in version 26.4.303 on September 11 before publishing an advisory on October 14.
Bottom line: On one server the attacker used the shell to hunt for credential stores and cryptocurrency wallets, including *.kdbx, wallet.dat and keystore.json files, and the administrator noted that anything the web server account can read must be treated as potentially exposed. Disabling the app does not close the hole, and Nextcloud 29 and older are end of life while the app store still serves them an affected version.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-66208CVE-2026-110447
- Related
- CISA Adds One Known Exploited Vulnerability to Catalog Cyber Risks · Oct 23, 2026CVE-2026-110447: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability Known Exploited Vulnerabilities · Oct 23, 2026