Collabora Fixes Remote Code Execution in Nextcloud's Built-in Office Server
Attackers planted web shells on Nextcloud servers using a flaw in the optional Collabora app. A patch is available for versions prior to 26.4.303.
Key points
- The flaw allows unauthenticated attackers to execute server commands when the local document server is not running.
- Collabora released version 26.4.303 on September 11 to fix the issue identified as CVE-2026-110447.
- Disabling the app does not mitigate the risk; administrators must update or remove the software entirely.
Attackers gained command-line access to Nextcloud servers by exploiting a vulnerability in the Collabora Online Built-in CODE Server app. According to The Hacker News, the flaw allowed threat actors to plant web shells that run with the privileges of the web server account. Three administrators reported the issue on GitHub, with the first logged attack occurring on September 10.
In plain English
The vulnerable app runs a local copy of the Collabora Office suite directly on the Nextcloud server. This setup lets users edit documents without needing a separate server. However, the app’s startup script contained a flaw that let attackers inject commands into the system. The attack only works when the local server is down, such as during a restart, upgrade, or crash.
The background
Collabora published an advisory on October 14 identifying the flaw as CVE-2026-110447. The company stated that the issue affects every version before 26.4.303. Standalone Collabora Online servers are not affected. The Hacker News reported that installations using only the Nextcloud Office app without the built-in server component remain safe, regardless of how their Collabora server is hosted.
What changes now
Administrators must update the app to version 26.4.303 or later. Collabora warned that simply disabling the app is insufficient to stop the attack because the vulnerable script remains on the server. The fixed versions require Nextcloud 30 or later. A warning on the Nextcloud community forum on October 3 reiterated that removing or updating the specific built-in app is the only mitigation.
What made it possible
Remote code execution flaws often arise when applications process user-controlled input without proper sanitization. In this case, the system placed request data into a shell command without neutralizing special characters. This allows an attacker to break out of the intended context and run arbitrary system commands. Teams usually monitor for unexpected file creation or outbound connections from web servers. Check whether your deployment uses optional local processing components that bypass standard application security controls. Ensure that all dependencies are updated promptly to close gaps in the attack surface.
What to do and how to stay safe: Nextcloud
- Verify if the Collabora Online Built-in CODE Server app is installed on your Nextcloud instances.
- Update the app to version 26.4.303 or higher once you confirm compatibility with your Nextcloud version.
- If updating is not immediately possible, remove the built-in app entirely rather than just disabling it.
- Monitor server logs for suspicious command execution or new files appearing in web directories.
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does disabling the Collabora app fix the vulnerability?
No, Collabora stated that disabling the app is not sufficient; it must be updated or removed.
Which Nextcloud versions are required for the fix?
The fixed versions of the app require Nextcloud 30 or later.
Are standalone Collabora servers affected by this flaw?
No, the advisory states that standalone Collabora Online servers are not affected.
