GoKawiilAttackers exploit unpatched Nextcloud Collabora flaw CVE-2026-110447 since September
Hackers have been exploiting a critical command injection vulnerability in Nextcloud's built-in Collabora Online CODE server app since at least September 10, weeks before the issue received a formal advisory and CVE number. The flaw lets unauthenticated attackers send a crafted request to the app's proxy.php endpoint and run system commands when the bundled CODE server is down, such as after a restart or crash, allowing them to plant PHP webshells and hunt for passwords and crypto wallets.
GoKawiil's interpretation of the reporting above, not reported fact.
The delay between active exploitation and the public CVE assignment left administrators unable to properly identify or patch the flaw for roughly a month, extending the window of exposure. Unconfirmed reports that ransomware groups are also leveraging the bug suggest the stakes could escalate beyond data theft if verified, though Nextcloud's standalone, Docker and AIO deployments are not affected.
- CVE-2026-110447 affects Nextcloud's optional richdocumentscode app before version 26.4.303.
- Exploitation requires no authentication but only works when the built-in CODE server is stopped.
- Admins should upgrade immediately, as disabling the vulnerable app alone does not stop exploitation.
Source: bleepingcomputer.com, 2026-10-15
Published there as: “Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.