A critical vulnerability in Nextcloud's Collabora Online CODE Server app has been exploited by hackers to execute operating system commands without authentication This article explores vulnerability nextcloud collabora. . This flaw, tracked as CVE-2026-110447, affects versions of richdocumentscode prior to 26.4.303 and was utilized in the wild during September and October 2026.

A critical Nextcloud Collabora flaw requires no privileges or user interaction, but a specific runtime condition must be met: the built-in CODE server must not be running when the malicious request reaches the vulnerable component. During these intervals, a crafted request can execute commands with the web server account's permissions, potentially accessing files, application secrets, and other resources. A public GitHub issue opened on September 11 detailed successful attacks against multiple Nextcloud servers running richdocumentscode 26.4.302.

The reporter provided access logs showing requests targeting /apps/richdocumentscode/proxy.php?status, and reported that attackers created PHP webshells within the application directory. Observed requests combined path traversal, shell command substitution, whitespace obfuscation, and Base64-encoded shell content. On one compromised installation, subsequent commands searched for password databases, cryptocurrency wallets, and password-manager artifacts, including KeePass databases and wallet.dat files.

Defenders should scrutinize application directories and access logs for unexpected PHP files, suspicious proxy.php requests, and subsequent command activity. Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort.