Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers

A critical remote command execution bug, now cataloged as CVE-2026-110447, has been actively abused since mid-September to compromise Nextcloud installations using the built-in Collabora Online CODE server app known as richdocumentscode. The flaw lives in how Nextcloud launches the bundled Collabora service and lets attackers send a crafted request to the proxy.php endpoint to inject OS commands without needing credentials or user interaction, provided the embedded CODE server happens to be down, for instance after a crash, update, or restart. Only the integrated app is at risk — standalone Collabora deployments, container/package installs, and All-in-One setups are not affected. Victims reported that intruders dropped PHP webshells to hunt for password manager files, credential stores, and crypto wallets, and some administrators suspected ransomware crews were also leveraging the hole, though this remains unverified. Admins are urged to patch to richdocumentscode 26.4.303 or newer, since simply disabling the vulnerable app does not remove the risk; notably, the official advisory and CVE assignment only emerged about a month after the fix shipped, leaving defenders without a clear reference point during the exploitation window.