A command-injection flaw in Nextcloud's optional built-in Collabora app, CVE-2026-110447, is being used to plant webshells. The CVE record scores it 9.2 and says it was exploited in September and October 2026. The fix is richdocumentscode 26.4.303.
What happened
The bug sits in proxy.php, the script that starts the bundled Collabora Online CODE server. If that server is not running, a remote attacker with no login can inject an operating-system command. A restart, an upgrade, or a crash is enough to open the window.
Collabora shipped 26.4.303 on 11 September. The CVE was published on 14 October. Administrator reports collected by BleepingComputer describe attacks from about 10 September, including PHP webshells used to look for password databases, password-manager files, and cryptocurrency wallets. BleepingComputer could not confirm separate claims that ransomware operators are using the flaw.
Disabling the app is not enough. Collabora says the app has to be updated or removed.
Who is affected
- Nextcloud sites running the optional Collabora Online Built-in CODE Server app (package richdocumentscode) before 26.4.303.
- Sites that restart often, because the injection only works while the bundled CODE server is stopped.
Standalone Collabora Online servers are not affected. Docker images, RPM and DEB packages, and Nextcloud All-in-One are not affected. Collabora says no Collabora Online customers were hit.
What to do now
Update the built-in CODE Server app to 26.4.303 or later, or remove it if the site does not need in-browser document editing.
- In the Nextcloud app store, confirm richdocumentscode is 26.4.303 or newer. Do not stop at disabling it.
- If the app was installed and the server restarted after 10 September, search the web root and app data for unexpected PHP files and new admin users.
- Rotate passwords stored in Nextcloud, and any password-manager or wallet files that lived on the same host, if a webshell is found.
- Prefer a standalone Collabora server, or drop in-browser editing, if the built-in app is only there because it was the default install path.
What this means for South African businesses
Nextcloud shows up in South African SMEs as a cheap file share and client portal, often on a VPS that an MSP last touched months ago. The built-in Collabora app is the easy install, not the recommended one, so a lot of those boxes have it and nobody remembers turning it on. The practical risk is a restart window: a routine update or a crash is exactly when this flaw can be hit, and the attacker does not need an account. If a client portal runs Nextcloud, check the app version this week rather than waiting for the next maintenance window.
Source: BleepingComputer, Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.