Collabora vulnerability CVE-2026-110447: is your Nextcloud server a target?
Many small businesses chose Nextcloud to keep their files in-house rather than in an American cloud. To edit Word and Excel documents right in the browser, an optional app is often added: Collabora Online – Built-in CODE Server. That’s the app at fault.
The Collabora vulnerability CVE-2026-110447 (severity 9.2 out of 10) lets a stranger, with no password, run a command on the server. Attackers have used it since September to drop a backdoor, and the U.S. agency CISA added it on October 23 to its catalog of actively exploited vulnerabilities. Here’s who is affected, how to check in four questions and what to look for if your server was exposed.
The Collabora vulnerability in short: a technical detail, a big consequence
The app installs a copy of Collabora directly on the Nextcloud server, which saves you a second server. Its app store listing actually presents it as meant for testing and small teams. The problem sits in a small script, proxy.php, that restarts the document engine when it isn’t running. Up to version 26.4.302, part of the requested address ended up inside a system command without being neutralized.
In practice, the attack only works while the document engine is stopped: a restart, an update or a crash. That sounds narrow, but servers restart more often than you’d think, and the attacker just has to try again.
The silent window: from quiet fix to official alert (2026 dates)
For over a month, the update existed, but nothing said it fixed a flaw that was already being exploited.
That timeline is the real lesson. The fix came out on September 11 with release notes that didn’t mention security. A small business that updates “when it has time” had no reason to treat it as urgent before October 14.
Are you affected?
🧭 Are you affected? Four questions, in order
richdocumentscode) installed, even if disabled?richdocuments) with a separate Collabora server: Docker, Linux package or hosting provider.To check the version, open Nextcloud with an administrator account, go to Apps, then search for “Built-in CODE Server”. If you don’t know who installed your Nextcloud or who updates it, that’s already an answer: it needs an owner.
Backdoor signs to look for
📄
Unknown PHP files
In the apps/richdocumentscode/ folder: names like shx…php, shrf…php or Nx_…php, reported by affected administrators.
🧾
Integrity check warning
Nextcloud reports an EXTRA_FILE in richdocumentscode: that’s how one administrator found the backdoor.
🔎
Odd requests in the logs
Hits on proxy.php?status whose address contains %2e%2e, $(, ${IFS} or base64, to check back to at least September 10.
🔐
sudo attempts
Failed sudo emails coming from the web server account: that’s what alerted a second administrator.
📡
Calls to webhook.site
The server contacting this public service: the attackers’ command sent it the system description.
If you find one of these signs: delete the suspicious file, update or remove the app, then change the passwords the web server can read (database, app passwords) and check that no other persistence mechanism was added. Keep a copy of the logs before cleaning up: they tell you what happened.
⚠️ Be wary of “free self-tests” shared on forums
In Nextcloud’s help thread about this flaw, a user posted links to “free” checking tools hosted elsewhere, and a moderator replied that they were keeping an eye on spammers. When a flaw makes the news, links like these multiply. Rely on Collabora’s official advisory, your Nextcloud’s app page and your own logs, not on an unknown site you would hand your server address to.
Frequently asked questions
Q1. We disabled the app. Is that enough?
No. Collabora says it plainly: disabling the app doesn’t fix the problem, it must be updated (26.4.303 or later) or removed. The faulty script is a plain PHP file that the web server runs directly, even when Nextcloud no longer uses the app.
Q2. Version 26.4.402 is out. Should we take it?
It rewrites the start command, but administrators report that it fails to start or to open documents on some setups, and several went back to 26.4.303, the version the official advisory names as the fix. Test it before installing it in production.
Q3. Our Nextcloud is hosted by a provider. Are we a target?
Probably not if your provider runs Collabora on a separate server, which is the usual case. Ask them directly: “Is the Built-in CODE Server app installed on our instance, and which version?”
Q4. We updated in September. Why keep looking?
Because the first known attack dates from September 10, the day before the fix, and an update doesn’t remove a backdoor that’s already in place. One administrator found a suspicious file after updating Nextcloud, thanks to the integrity check.
An office Nextcloud server is a server exposed to the Internet, just like a website. We saw it with this week’s critical PHP vulnerability and with the AhsayCBS vulnerability on backup servers: tools you host yourself to stay in control need close follow-up.
At NeoTech, our server management service keeps your apps up to date and reads security advisories for you, and our backup and disaster recovery lets you restart from a clean copy. With our cyber monitoring, automated 24/7 monitoring with on-call technician response spots unexpected files and suspicious requests on your servers.
Book your free cyber check
Do you host Nextcloud or another tool yourself and aren’t sure exactly what’s installed on it? The free cyber check starts with an inventory of your exposed servers and their updates, then we hand you a clear plan.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- CISA: CVE-2026-110447 added to the Known Exploited Vulnerabilities (KEV) catalog (October 23, 2026)
- Collabora, GitHub: advisory GHSA-g3vx-3m76-fghh, command injection in richdocumentscode (October 14, 2026)
- The Hacker News: Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App (October 14, 2026)
- The Hacker News: CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud (October 24, 2026)
- Nextcloud forum: To Collabora Built-in User: Update ASAP (October 3 to 17, 2026)
Photo: Brett Sayles, Pexels (Pexels licence).