server · disclosed 11 September 2026
Collabora Built-in CODE Server for Nextcloud exploited to plant web shells
A command-injection flaw (CVE-2026-110447) in the Built-in CODE Server app for Nextcloud lets an unauthenticated attacker run commands with web server privileges when the local Collabora server is offline. Attackers have used it since at least 10 September to plant PHP web shells and target credential stores and cryptocurrency wallet files. CISA added it to its actively exploited list on 23 October.
- Detectable by a website scanNo, server-side only
- Last reviewed24 October 2026
Timeline
- First reported attack logged by an administrator.
- Built-in CODE Server 26.4.303 released with the fix.
- CISA adds CVE-2026-110447 to its Known Exploited Vulnerabilities catalog.
Affected packages
| Package | Affected versions |
|---|---|
richdocumentscode (Nextcloud app) | before 26.4.303 |
What to do
- Update the Built-in CODE Server app to 26.4.303 or later, or remove it. Disabling it is not enough: its proxy stays reachable while the files are present.
- Search the Nextcloud web root for PHP files you didn't put there (web shells), especially recent ones.
- Rotate credentials stored on the server and review admin accounts.
- If you don't need the built-in server, connect Nextcloud Office to a separately hosted Collabora instead.
Sources
- GitHub advisory GHSA-f97p-r72q-64h2
- CVE-2026-110447 record
- eSecurity Planet: Hackers use critical Collabora flaw to compromise Nextcloud servers
- CISA Known Exploited Vulnerabilities catalog
We update this page as new information is published. Package versions are also checked live against OSV.dev during every audit, so newly flagged versions are caught even before this page changes.