Cybersecurity
Attackers exploited Collabora flaw in Nextcloud servers
Attackers used CVE-2026-110447 in Nextcloud’s bundled Collabora app, planted PHP webshells on some systems and kept exploiting the bug before the formal advisory and CVE entry appeared.
- System administrators said exploitation of CVE-2026-110447 began in mid-September, about a month before the advisory and CVE entry were published.
- Collabora said the flaw affected richdocumentscode before version 26.4.303 and only the optional built-in CODE server app.
- The reports said attackers sent crafted requests to proxy.php, caused command injection when the bundled server was stopped, and left PHP webshells on compromised systems.
- Some reports said ransomware operators were also using the flaw, but BleepingComputer said it could not verify that claim.
- Collabora said the fix was committed on 9 September, version 26.4.303 shipped on 11 September, and the advisory and CVE were published on 14 October.
Administrators reported attacks against multiple endpoints from 10 September onwards, and the first signs of abuse dated to mid-September. The formal bulletin, GitHub advisory and CVE entry came later.
Collabora said CVE-2026-110447 affected richdocumentscode releases before 26.4.303 and only the optional built-in server. It said standalone Collabora Online deployments, Docker and RPM/DEB packages, and Nextcloud All-in-One were not affected.
According to the reports, attackers used requests against proxy.php to trigger OS command injection when the built-in server was not running. The activity included PHP webshells and searches for password databases, password-manager files and cryptocurrency wallets.
BleepingComputer said some users had linked the activity to ransomware operators, but it did not confirm that. Nextcloud said Collabora had told it about the issue in mid-September and that an update was available from the app store.
Collabora said the fix had been committed on 9 September and version 26.4.303 had been released on 11 September. It later said the delay in public disclosure was mainly due to GitHub CVE-processing backlogs, while a Second Security study described a wider gap between fixes and CVE publication.
Named in this story
Companies
- Nextcloud
- was the platform whose users were affected and which responded to BleepingComputer
- Collabora
- said the flaw was limited to the built-in app and later blamed GitHub CVE backlogs for the delay
- Second Security
- published a study on the gap between security fixes and CVE publication
Organisations
- GitHub
- had its CVE-processing backlog cited as a cause of the publication delay
- BleepingComputer
- contacted Nextcloud and said it could not confirm the ransomware claim
Products and systems
- Collabora Online - Built-in CODE Server app (richdocumentscode)
- was the vulnerable Nextcloud app targeted by the attacks
How the source tells it
The article was mostly neutral, with a mild sense of urgency and uncertainty created by active-exploitation warnings and an explicitly unverified ransomware claim.
- urgency repeated warnings to update quickly and references to exploitation already under way
- uncertainty the ransomware angle was reported as unconfirmed and the disclosure delay was explained with competing attributions