Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App

Security researchers report active exploitation of a critical flaw in Collabora's optional "Built-in CODE Server" app (richdocumentscode) used by Nextcloud Office, tracked as CVE-2026-110447. The bug lets an unauthenticated attacker inject shell commands through the app's proxy.php script whenever its local document server isn't running—such as during a restart, upgrade, or crash—allowing a web shell to be dropped on the Nextcloud host. At least three administrators confirmed compromises starting September 10, with attackers in one case searching for cryptocurrency wallets and credential files like kdbx and wallet.dat. Collabora patched the issue in version 26.4.303 on September 11 but only published the advisory on October 14; simply disabling the app does not mitigate the flaw, so affected installations must upgrade or remove richdocumentscode entirely, with older Nextcloud releases (29 and earlier) requiring a full platform upgrade.